# Table of Contents - [Open Surface RT Home | Open Surface RT](#open-surface-rt-home-open-surface-rt) - [Get started | Open Surface RT](#get-started-open-surface-rt) - [Linux | Open Surface RT](#linux-open-surface-rt) - [Secure Boot | Open Surface RT](#secure-boot-open-surface-rt) - [Windows 10 | Open Surface RT](#windows-10-open-surface-rt) - [Boot Process | Open Surface RT](#boot-process-open-surface-rt) - [Windows 10 | Open Surface RT](#windows-10-open-surface-rt) - [Tegra SoC's | Open Surface RT](#tegra-soc-s-open-surface-rt) - [Special Boot modes | Open Surface RT](#special-boot-modes-open-surface-rt) - [Payloads | Open Surface RT](#payloads-open-surface-rt) - [APX Mode (USB Recovery Mode "RCM") | Open Surface RT](#apx-mode-usb-recovery-mode-rcm-open-surface-rt) - [Fusée Gelée | Open Surface RT](#fus-e-gel-e-open-surface-rt) - [Changelog | Open Surface RT](#changelog-open-surface-rt) - [UEFI | Open Surface RT](#uefi-open-surface-rt) - [Secure Boot | Open Surface RT](#secure-boot-open-surface-rt) - [Windows Bootmanager Exploit | Open Surface RT](#windows-bootmanager-exploit-open-surface-rt) - [Fake Builds | Open Surface RT](#fake-builds-open-surface-rt) - [Windows RT | Open Surface RT](#windows-rt-open-surface-rt) - [Jailbreak Exploits | Open Surface RT](#jailbreak-exploits-open-surface-rt) - [Known Issues | Open Surface RT](#known-issues-open-surface-rt) - [UEFI Boot Sequence | Open Surface RT](#uefi-boot-sequence-open-surface-rt) - [APX devicetree | Open Surface RT](#apx-devicetree-open-surface-rt) - [FAT32 isn't FAT32 | Open Surface RT](#fat32-isn-t-fat32-open-surface-rt) - [Devicetree | Open Surface RT](#devicetree-open-surface-rt) - [Kernel source | Open Surface RT](#kernel-source-open-surface-rt) - [UEFI devicetree | Open Surface RT](#uefi-devicetree-open-surface-rt) - [Appended devicetree | Open Surface RT](#appended-devicetree-open-surface-rt) - [Recovery Images | Open Surface RT](#recovery-images-open-surface-rt) - [Yahallo - Disable Secureboot | Open Surface RT](#yahallo-disable-secureboot-open-surface-rt) - [Booting | Open Surface RT](#booting-open-surface-rt) - [grate-driver | Open Surface RT](#grate-driver-open-surface-rt) - [Configure & Build | Open Surface RT](#configure-build-open-surface-rt) - [Kernel | Open Surface RT](#kernel-open-surface-rt) - [Kernel parameters | Open Surface RT](#kernel-parameters-open-surface-rt) - [Simple RootFS | Open Surface RT](#simple-rootfs-open-surface-rt) - [Root Filesystem | Open Surface RT](#root-filesystem-open-surface-rt) - [Trouble Shooting | Open Surface RT](#trouble-shooting-open-surface-rt) - [postmarketOS | Open Surface RT](#postmarketos-open-surface-rt) - [Recovery Toolkit | Open Surface RT](#recovery-toolkit-open-surface-rt) - [Tegra3 - Technical Reference Manual | Open Surface RT](#tegra3-technical-reference-manual-open-surface-rt) - [Fusée Gelée | Open Surface RT](#fus-e-gel-e-open-surface-rt) - [Prebuilt binaries | Open Surface RT](#prebuilt-binaries-open-surface-rt) - [Mainline | Open Surface RT](#mainline-open-surface-rt) - [Hardware | Open Surface RT](#hardware-open-surface-rt) - [APX boot | Open Surface RT](#apx-boot-open-surface-rt) - [Distributions | Open Surface RT](#distributions-open-surface-rt) - [J14 OEM Debug Connector | Open Surface RT](#j14-oem-debug-connector-open-surface-rt) - [Das U-Boot | Open Surface RT](#das-u-boot-open-surface-rt) - [Linux | Open Surface RT](#linux-open-surface-rt) - [1.8V UART with Voltage divider | Open Surface RT](#1-8v-uart-with-voltage-divider-open-surface-rt) - [UART | Open Surface RT](#uart-open-surface-rt) - [Raspberry Pi OS | Open Surface RT](#raspberry-pi-os-open-surface-rt) - [UEFI boot | Open Surface RT](#uefi-boot-open-surface-rt) - [Firmware | Open Surface RT](#firmware-open-surface-rt) - [Decrypt Firmware | Open Surface RT](#decrypt-firmware-open-surface-rt) - [RPMB partition on EMMC | Open Surface RT](#rpmb-partition-on-emmc-open-surface-rt) - [Boot Linux | Open Surface RT](#boot-linux-open-surface-rt) - [Encrypt Firmware | Open Surface RT](#encrypt-firmware-open-surface-rt) - [BCT | Open Surface RT](#bct-open-surface-rt) - [Raspberry Pi UART-Setup | Open Surface RT](#raspberry-pi-uart-setup-open-surface-rt) - [PinMux | Open Surface RT](#pinmux-open-surface-rt) - [GPIOs in Linux | Open Surface RT](#gpios-in-linux-open-surface-rt) - [Extract Firmware | Open Surface RT](#extract-firmware-open-surface-rt) - [Memory Mapping | Open Surface RT](#memory-mapping-open-surface-rt) - [WDSA | Open Surface RT](#wdsa-open-surface-rt) - [Lenovo Ideapad Yoga 11 | Open Surface RT](#lenovo-ideapad-yoga-11-open-surface-rt) - [4 - eMMC | Open Surface RT](#4-emmc-open-surface-rt) - [MMC | Open Surface RT](#mmc-open-surface-rt) - [Compiling GRUB2 | Open Surface RT](#compiling-grub2-open-surface-rt) - [1 - μSD Card | Open Surface RT](#1-sd-card-open-surface-rt) - [3 - WIFI SDIO: Marvell: 88W8797 | Open Surface RT](#3-wifi-sdio-marvell-88w8797-open-surface-rt) - [Bus 3 - HDMI DDC | Open Surface RT](#bus-3-hdmi-ddc-open-surface-rt) - [LVDS Encoder | Open Surface RT](#lvds-encoder-open-surface-rt) - [Not interesting (yet) | Open Surface RT](#not-interesting-yet-open-surface-rt) - [GPIOs | Open Surface RT](#gpios-open-surface-rt) - [Memory Mapping | Open Surface RT](#memory-mapping-open-surface-rt) - [I2C devices | Open Surface RT](#i2c-devices-open-surface-rt) - [UEFI | Open Surface RT](#uefi-open-surface-rt) - [DSDT | Open Surface RT](#dsdt-open-surface-rt) - [EFI System Tables | Open Surface RT](#efi-system-tables-open-surface-rt) - [Battery | Open Surface RT](#battery-open-surface-rt) - [Display | Open Surface RT](#display-open-surface-rt) - [Battery | Open Surface RT](#battery-open-surface-rt) - [BCT Table | Open Surface RT](#bct-table-open-surface-rt) - [ACPI (DSDT) Tables | Open Surface RT](#acpi-dsdt-tables-open-surface-rt) - [Hardware | Open Surface RT](#hardware-open-surface-rt) - [IC's | Open Surface RT](#ic-s-open-surface-rt) - [IC's | Open Surface RT](#ic-s-open-surface-rt) - [Bus 0 - MS HID | Open Surface RT](#bus-0-ms-hid-open-surface-rt) - [Display | Open Surface RT](#display-open-surface-rt) - [Bus 2 - CAMs | Open Surface RT](#bus-2-cams-open-surface-rt) - [ACPI Tables | Open Surface RT](#acpi-tables-open-surface-rt) - [Software Support | Open Surface RT](#software-support-open-surface-rt) - [Linux | Open Surface RT](#linux-open-surface-rt) - [Specifications | Open Surface RT](#specifications-open-surface-rt) - [Bus 1 - 2nd Board | Open Surface RT](#bus-1-2nd-board-open-surface-rt) - [Bus 4 - System | Open Surface RT](#bus-4-system-open-surface-rt) - [SPI Flash | Open Surface RT](#spi-flash-open-surface-rt) - [MADT / APIC | Open Surface RT](#madt-apic-open-surface-rt) - [RSDP | Open Surface RT](#rsdp-open-surface-rt) - [!TODO for everyone | Open Surface RT](#-todo-for-everyone-open-surface-rt) - [BGRT | Open Surface RT](#bgrt-open-surface-rt) - [MSDM | Open Surface RT](#msdm-open-surface-rt) - [Cross Compiling | Open Surface RT](#cross-compiling-open-surface-rt) - [XSDT | Open Surface RT](#xsdt-open-surface-rt) - [jwa4 Notes | Open Surface RT](#jwa4-notes-open-surface-rt) - [Devicetree information | Open Surface RT](#devicetree-information-open-surface-rt) - [Do gifs work? | Open Surface RT](#do-gifs-work-open-surface-rt) - [FACP | Open Surface RT](#facp-open-surface-rt) - [Surface RT & 2 Jailbreak USB | Open Surface RT](#surface-rt-2-jailbreak-usb-open-surface-rt) - [decode - Pin number to Letter | Open Surface RT](#decode-pin-number-to-letter-open-surface-rt) - [UEFI Privilege Escalation Exploit Documentation | Open Surface RT](#uefi-privilege-escalation-exploit-documentation-open-surface-rt) - [Leander devNotes | Open Surface RT](#leander-devnotes-open-surface-rt) - [Uboot information | Open Surface RT](#uboot-information-open-surface-rt) - [Interesting Repo's | Open Surface RT](#interesting-repo-s-open-surface-rt) - [!!! PLEASE READ !!! | Open Surface RT](#-please-read-open-surface-rt) - [CTS devNotes | Open Surface RT](#cts-devnotes-open-surface-rt) - [CSRT | Open Surface RT](#csrt-open-surface-rt) - [Windows Media Builder | Open Surface RT](#windows-media-builder-open-surface-rt) - [initrd | Open Surface RT](#initrd-open-surface-rt) - [EFI linux booting | Open Surface RT](#efi-linux-booting-open-surface-rt) - [Kernel module | Open Surface RT](#kernel-module-open-surface-rt) - [!TODO | Open Surface RT](#-todo-open-surface-rt) - [Surface 2 | Open Surface RT](#surface-2-open-surface-rt) - [Yahallo: Free memory access | Open Surface RT](#yahallo-free-memory-access-open-surface-rt) - [git for dummys [WIP!] (like me) | Open Surface RT](#git-for-dummys-wip-like-me-open-surface-rt) - [SSDT | Open Surface RT](#ssdt-open-surface-rt) - [Dump Bootrom | Open Surface RT](#dump-bootrom-open-surface-rt) - [Surface RT | Open Surface RT](#surface-rt-open-surface-rt) - [Qemu emulation | Open Surface RT](#qemu-emulation-open-surface-rt) - [TZ Exploit - CTS | Open Surface RT](#tz-exploit-cts-open-surface-rt) - [Device Tables | Open Surface RT](#device-tables-open-surface-rt) - [FPDT | Open Surface RT](#fpdt-open-surface-rt) - [tCover Linux support | Open Surface RT](#tcover-linux-support-open-surface-rt) - [UEFI Privilege Escalation: Execute code in Secure mode | Open Surface RT](#uefi-privilege-escalation-execute-code-in-secure-mode-open-surface-rt) - [TMP2 | Open Surface RT](#tmp2-open-surface-rt) - [DBG2 | Open Surface RT](#dbg2-open-surface-rt) - [EFI Signing / Secure Boot | Open Surface RT](#efi-signing-secure-boot-open-surface-rt) - [battery | Open Surface RT](#battery-open-surface-rt) - [Removing trustzone | Open Surface RT](#removing-trustzone-open-surface-rt) - [Configs we already tried | Open Surface RT](#configs-we-already-tried-open-surface-rt) - [GRUB2 Booting Notes | Open Surface RT](#grub2-booting-notes-open-surface-rt) - [!TODO | Open Surface RT](#-todo-open-surface-rt) --- # Open Surface RT Home | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252FJUP60OQ89epw3egpCkqJ%252Fsrt-revised-render6-ver2-keyboard-legends2-screen-reflection2.png%3Falt%3Dmedia%26token%3Dcbf93bec-108c-475d-b3c0-210554f393f1&width=768&dpr=3&quality=100&sign=4603f231&sv=2) circle-check * Current Hardware support: Type-/TouchCover, (Touch-)Screen, USB, SD Card, eMMC, HDMI, Buttons(Vol+/-, PWR, Windows), (UART-A), WiFi, Audio * Any ARM32 distro works * Booting Linux from UEFI is possible. You can boot Linux with a tethered exploit (better performance) or UEFI. You will be able to use the Raspberry Pi OS Desktop, postmarketOS or any other ARM32/ARMHF distro. You can interact with it via Touchscreen, Type-/TouchCover and USB peripherals (Keyboard, Mouse, USB-Ethernet) circle-info Join our Discord server down below! [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fdiscord.com%2Fassets%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=3c4d8bef&sv=2)Join the Open RT Discord Server!Discordchevron-right](https://discord.gg/VW75GmWa95) [NextGet startedchevron-right](https://open-rt.gitbook.io/open-surfacert/get-started) Last updated 7 months ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Get started | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#what-to-do-with-windows-rt-devices) What to do with Windows RT devices? -------------------------------------------------------------------------------------------------------------------------------------------- Windows RT was limited from the beginning. It didn't allow to run 3rd party desktop apps and therefore you weren't able to run your favorit apps. On the one hand it was Microsofts fault as they closed down the desktop for 3rd party apps. On the other hand Windows RT devices run on ARM32 processors. This means that the CPU speaks another language than your desktop x86/AMD64 CPU. 3rd Party apps need to be compatible with ARM32. But due to the closed System no company ported their Application to Windows RT. Most if not all program you which currently run on Windows RT were ported by hobbyists or were taken from other Platforms like Windows Mobile. Thefore most Windows RT devices ended up in a draw and were forgotten. Most people paid a lot of money for them but now they are reasonably cheap but they aren't more useful than 8 years ago. App support is getting worse day by day. The only browser you get is Internet Explorer and it already doesn't work with most famous pages. However the look and feel of the devices is great and they still have some power left. The battery life is great thanks to the early mentioned ARM processor. We like to show you some solutions. Some are ready for daily use others are for tech nerds who love to play with it. But first we have to solve a problem created by Microsoft: Secure Boot. [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#secure-boot) Secure Boot --------------------------------------------------------------------------------------------- Secure Boot is a really nice thing in theory. It prevents attackers from booting malware on your PC. Your UEFI firmware checks the signature of the EFI app which will be booted. In Most cases this a bootloader which will load your OS like Windows Bootmanager or GRUB2. Most UEFI systems only accept files signed by Microsoft. This is a problem if you want to boot a 3rd party unsigned OS like Linux. On Desktop system you could add the secure boot key of your Linux distribution creator and you are safe. The other alternative is to disable secure boot. This is much easier but opens a small window were attackers can take control over your PC. Microsoft being Microsoft and didn't gave us an option to disable secure boot on Windows RT devices. Luckily there are there are a few exploits which deal with secure boot on ARM32 devices. First there was a secure boot bypass which allowed to boot test-signed Windows Bootmanager apps. It was followed by another exploit which is able to disable secure boot entirely. Disabling secure boot only works on Surface RT and Surface 2. Instruction for bypassing or disableing secure boot can be found below. [Secure Bootchevron-right](https://open-rt.gitbook.io/open-surfacert/get-started/secure-boot) [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#windows-10-on-arm32) Windows 10 on ARM32 ------------------------------------------------------------------------------------------------------------- The first solution is Windows 10. Yes you heard right Windows 10 runs on Windows RT devices. And by Windows RT devices we mean all of them: Surface RT, Surface 2, Asus Vivo Tab RT, Lenovo Ideapad Yoga 11 and so on. But there's a catch: it isn't an official build. It was leaked 5 years ago. This brings some pros and cons with it. It comes with Microsoft's Edge Browser which is newer but also starts to struggle with newer pages. You also get access to a larger library of apps which might be something you are looking for. [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#linux) Linux --------------------------------------------------------------------------------- Linux runs on pretty much anything and so it does on Windows RT devices. They run on Nvidia Tegra SoC's (System on Chip). These SoC's have are mainlined and therefore and run plain Linux but they aren't fully supported. For example they are lacking OpenGL/3D hardware acceleration. There are a few more problems caused by the UEFI firmware running on Windows RT devices. Firmware prevents Linux from managing power settings and other essential stuff like: CPU Voltage/Frequency Scaling, L2 Cache, Regulator management. Linux apps are still limited to ARM apps but the selection is much bigger as long as you look for traditional Linux desktop apps. Not all devices can run Linux very well. Some are better supported than others. Furthermore there are different ways to boot those devices. One way is to use the UEFI firmware which is easy and doesn't requires any special equipment other than an USB drive. The other way is booting via APX which requires a x86 Linux PC and a USB A-to-A cable every time you want to boot your device. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#uefi-vs-apx) UEFI vs APX In most cases you will decide to boot via UEFI whether it be related to the fact that you need your Host every time you want to boot or the fact that you have no USB A-to-A cable. But why do we mention APX if it is more annoying than UEFI booting? Let us explain with a little analogy. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#uefi) UEFI: You have an older timer. It looks nice but it isn't the fastest car anymore. Also something is broken and you can only drive in 2nd gear. Not very fast but you eventually reach your destination. You want to stop the car but the motor keeps running using fuel. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#apx) APX: You have the same old timer but it ain't broken. It can shift gears to go faster or slower to save energy. The motor can be stopped but you need jumper cables everytime want to start it. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#supported-devices) Supported devices Currently supported devices are: Surface RT, Lenovo ideapad yoga 11, Asus Vivotab RT and Surface 2 #### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#surface-rt) Surface RT It is pretty well supported it just misses some features like bluetooth and microphones. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#asus-vivo-tab-rt) Asus Vivo Tab RT Is is pretty well supported too. It is mainted by another group #### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#lenovo-ideapad-yoga-11) Lenovo Ideapad Yoga 11 It has some hardware support but somethings are still missing. We would appreciate if you are willing to test somethings. Feel free to contact us at discord :) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#distributions) Distributions Any ARM32 distro can be used. Most popular are postmarketOS and Raspberry Pi OS. Arch, Void, Ubuntu, Kali were reported to work too. See below for more informations: [Distributionschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros) [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started#android) Android ------------------------------------------------------------------------------------- No attempts at porting Android were made so far. [PreviousOpen Surface RT Homechevron-left](https://open-rt.gitbook.io/open-surfacert) [NextSecure Bootchevron-right](https://open-rt.gitbook.io/open-surfacert/get-started/secure-boot) Last updated 7 months ago Was this helpful? * [What to do with Windows RT devices?](https://open-rt.gitbook.io/open-surfacert/get-started#what-to-do-with-windows-rt-devices) * [Secure Boot](https://open-rt.gitbook.io/open-surfacert/get-started#secure-boot) * [Windows 10 on ARM32](https://open-rt.gitbook.io/open-surfacert/get-started#windows-10-on-arm32) * [Linux](https://open-rt.gitbook.io/open-surfacert/get-started#linux) * [UEFI vs APX](https://open-rt.gitbook.io/open-surfacert/get-started#uefi-vs-apx) * [Supported devices](https://open-rt.gitbook.io/open-surfacert/get-started#supported-devices) * [Distributions](https://open-rt.gitbook.io/open-surfacert/get-started#distributions) * [Android](https://open-rt.gitbook.io/open-surfacert/get-started#android) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Linux | Open Surface RT WIP [PreviousWindows 10chevron-left](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10) [NextChangelogchevron-right](https://open-rt.gitbook.io/open-surfacert/changelog) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Secure Boot | Open Surface RT WIP [PreviousGet startedchevron-left](https://open-rt.gitbook.io/open-surfacert/get-started) [NextWindows 10chevron-right](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Windows 10 | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#wip) WIP ---------------------------------------------------------------------------------------- THIS IS A TEMPORARY INSTALL GUIDE, CLEANER AND MORE DETAILED ONE IS IN WORKS SORRY FOR INCONVENIENCES [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#getting-started) Getting started... ------------------------------------------------------------------------------------------------------------------- Now that you know which tablet you got, pay closer attention on the exact installation method as it **may** differ. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#stuff-you-need) Stuff you need * [https://forum.xda-developers.com/t/windows-10-build-15035-media-builder.4232301/arrow-up-right](https://forum.xda-developers.com/t/windows-10-build-15035-media-builder.4232301/) * Brain with more than 2 braincells, pair of hands and reading skills * Recovery image restored tablet with no updates installed (no WiFi turned on) * Jailbreak: [https://openrt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/surface-rt-and-surface-2-jailbreak-usbarrow-up-right](https://openrt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/surface-rt-and-surface-2-jailbreak-usb) [hashtag](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#exploiting-for-installation) Exploiting for installation ---------------------------------------------------------------------------------------------------------------------------------------- Before continuing, this is the most crucial part to get the tablets running on Windows 10. 1. Sometimes you have to clear the eMMC to proceed, this can only happen when you've updated past a point where jailbreaks no longer work or you used Alexen's guide Assuming there is nothing on there you need to keep do the following from WinRE command prompt, you can use the same BMR or Media Builder USB to get to command prompt. Power off, insert USB with your recovery files and boot from it by holding vol down while powering on. Once its booted do this: Copy 1. Select keyboard layout. 2. Select "Troubleshoot". 3. Select "Advanced Options". 4. Select "Command Prompt". At command prompt type the following: Copy diskpart sel dis 0 clean exit Power off, insert USB with your recovery files and boot from it by holding vol down while powering on. Once its booted do this: Copy 1. Select keyboard layout. 2. Select "Troubleshoot". 3. Select "Reset your PC". 4. Select target OS to be replaced if there is one, this step won't exist if you clear the eMMC before starting. 5. Select "Next". 6. Select "Yes, repartition the drives". 7. Choose desired drive erasure level . 8. Select "Reset". 2. Follow [https://openrt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/surface-rt-and-surface-2-jailbreak-usbarrow-up-right](https://openrt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/surface-rt-and-surface-2-jailbreak-usb) to set up jailbreak on your device 3. Generate an image using [https://forum.xda-developers.com/t/windows-10-build-15035-media-builder.4232301/arrow-up-right](https://forum.xda-developers.com/t/windows-10-build-15035-media-builder.4232301/) 4. Plug the drive into your tablet and boot off of it by pressing `Power` and holding `Volume down` 5. Follow the on-screen guide and you're good to go! Point 1: [PreviousSecure Bootchevron-left](https://open-rt.gitbook.io/open-surfacert/get-started/secure-boot) [NextLinuxchevron-right](https://open-rt.gitbook.io/open-surfacert/get-started/linux) Last updated 4 years ago Was this helpful? * [WIP](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#wip) * [Getting started...](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#getting-started) * [Exploiting for installation](https://open-rt.gitbook.io/open-surfacert/get-started/windows-10#exploiting-for-installation) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Boot Process | Open Surface RT Boot process can be divided in 2 different sections. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence#soc-boot-process) SOC Boot process ---------------------------------------------------------------------------------------------------------------- First comes the SoC boot process. This prepares the SoC to execute more capable firmware/bootloaders which will eventually load a Operating System. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence#uefi-boot-process) UEFI Boot process ------------------------------------------------------------------------------------------------------------------ Once the UEFI Firmware is loaded it needs to decide which files should be booted next. [PreviousChangelogchevron-left](https://open-rt.gitbook.io/open-surfacert/changelog) [NextSpecial Boot modeschevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes) Last updated 4 years ago Was this helpful? * [SOC Boot process](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence#soc-boot-process) * [UEFI Boot process](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence#uefi-boot-process) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Windows 10 | Open Surface RT Despite previous statements to the contrary, Microsoft announced that ARMv7 Surface devices would remain on Windows RT 8.1 in January 2015. Following this announcement the devices were effectively abandoned. During a security breach at Microsoft in early 2017 build 15035 of Windows 10 Creators Update was obtained, this build eventually leaked to [BetaArchive arrow-up-right](https://www.betaarchive.com/) on 24th November 2019. This build is currently the only leaked Windows 10 client build available for ARMv7 processors. Although this build is not generally considered suitable for daily use, it has attracted some interest from the remaining users of ARMv7 devices as an unofficial upgrade from Windows RT. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MQ8oOYc52TXfBzmuFFA%252F-MQ8oYiJDvkwM2V7Jtjd%252F15035-About.png%3Falt%3Dmedia%26token%3Dec9eae10-9a6d-4a2c-b3f4-10a10f4b7031&width=768&dpr=3&quality=100&sign=bd419c7c&sv=2) [Windows 10 build 15035arrow-up-right](https://betawiki.net/wiki/Windows_10_build_15035) by [BetaWikiarrow-up-right](https://betawiki.net/) , used under [CC BYarrow-up-right](https://creativecommons.org/licenses/by-sa/4.0/) / Desaturated from original [PreviousRecovery Imageschevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images) [NextSoftware Supportchevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software) Last updated 2 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Tegra SoC's | Open Surface RT Every Tegra SoC contains a small built in ROM. Tegra3 has one which is 48kB in size. This ROM is called **BootRom**. The Bootrom is responsible for initial SoC setup. The code stored in bootrom will execute on the Boot and Power Management Processor (BPMP) which is a ARM7TDMI(ARMv4T) CPU. Until DRAM is setup it can only use iRam which is only 64kB in size. After DRAM setup it will load a Bootloader to DRAM and transfers control to it. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#how-the-bootrom-works) How the Bootrom works ------------------------------------------------------------------------------------------------------------------------------------------------- 1. Checks fuse or strap to decide which boot device should be used. 2. Try to read a valid signed BCT 3. Set up DRAM according to BCT 4. Load a hashed Bootloader specified in BCT and execute it 5. If no valid Bootloader is found it enters USB recovery mode (RCM/APX) From there its the firmware job to setup the main CPU (ARMv7-Cortex-A9) and transfer control to the main CPU. This part of the firmware/bootloader is called Secondary ProgramLoader (SPL). On a stock Surface RT/2 this bootloader is UEFI TianoCore EDK2 which provides the UEFI API. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#fusee-gelee-bootrom-exploit) Fusée Gelée - BootRom Exploit USB recovery mode can be exploited. See [Fusée Gelée](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#further-reading) Further reading ------------------------------------------------------------------------------------------------------------------------------------- [http://http.download.nvidia.com/tegra-public-appnotes/tegra-boot-flow.htmlarrow-up-right](http://http.download.nvidia.com/tegra-public-appnotes/tegra-boot-flow.html) [PreviousSpecial Boot modeschevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes) [NextFusée Geléechevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee) Last updated 5 years ago Was this helpful? * [How the Bootrom works](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#how-the-bootrom-works) * [Fusée Gelée - BootRom Exploit](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#fusee-gelee-bootrom-exploit) * [Further reading](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#further-reading) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Special Boot modes | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes#uefi-boot-from-usb) UEFI Boot from USB --------------------------------------------------------------------------------------------------------------------------------------- 1. Prepare USB: format it as FAT32 and copy your files 2. Insert USB into your Surface 3. Hold `Vol-Down` 4. Press `PWR` 5. Wait until the Surface logo shows and wait some more seconds 6. Release `Vol-Down` circle-info To boot unsigned non Microsoft UEFI Apps you need to apply [Yahallo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot) first [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes#apx-tegra-recovery-mode) APX - tegra recovery mode --------------------------------------------------------------------------------------------------------------------------------------------------- 1. Connect your Tegra3/4 via an USB A-to-A cable to an USB 3.0 Port of your PC 2. Hold `Vol-Up` 3. Press `PWR` 4. Release `Vol-Up` it should immediately boot into APX mode 5. Use your payload sender to send data ([Fusée Gelée](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee) ) circle-info Newer PCs can use an USB Type C cable instead of USB A-to-A cable [PreviousBoot Processchevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence) [NextTegra SoC'schevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process) Last updated 4 years ago Was this helpful? * [UEFI Boot from USB](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes#uefi-boot-from-usb) * [APX - tegra recovery mode](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes#apx-tegra-recovery-mode) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Payloads | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#spam-uart-a-tx) Spam UART A TX -------------------------------------------------------------------------------------------------------------------------------------------------------- file-download 543B [spam\_uartA\_payload.bin](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJWU4eAUVh_gju5e1za%2F-MJWUwsbGTZVsNfbp_pf%2Fspam_uartA_payload.bin?alt=media&token=e8a51401-9650-4f87-84a5-183500452c38) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJWU4eAUVh_gju5e1za%2F-MJWUwsbGTZVsNfbp_pf%2Fspam_uartA_payload.bin?alt=media&token=e8a51401-9650-4f87-84a5-183500452c38) FuseeGeleePayload - Spams UART-A-TX file-download 6KB [uart\_payload.c](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJWU4eAUVh_gju5e1za%2F-MJWWAgnwDZpSFg8KJf5%2Fuart_payload.c?alt=media&token=cefa6302-e1e1-4bbd-af37-71028570b27f) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJWU4eAUVh_gju5e1za%2F-MJWWAgnwDZpSFg8KJf5%2Fuart_payload.c?alt=media&token=cefa6302-e1e1-4bbd-af37-71028570b27f) FuseeGeleePayload - Spams UART-A-TX (source) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#echo-uart-rx-to-tx) ECHO UART RX to TX ---------------------------------------------------------------------------------------------------------------------------------------------------------------- work in progress. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#hardware-pinmux) Hardware (PinMUX) ------------------------------------------------------------------------------------------------------------------------------------------------------------ Looks like UARTA is using the ULPI pins as noted here ([https://github.com/u-boot/u-boot/blob/master/arch/arm/mach-tegra/tegra30/pinmux.c#L238arrow-up-right](https://github.com/u-boot/u-boot/blob/master/arch/arm/mach-tegra/tegra30/pinmux.c#L238) ) So we know we can setup our UARTA and UARTD on the ULPI pins `#if defined UARTA /* set pinmux for uart-a (nexus 7) */ reg_write(PINMUX_BASE, PINMUX_AUX_ULPI_DATA0_0, 0b00000110); /* tx */ reg_write(PINMUX_BASE, PINMUX_AUX_ULPI_DATA1_0, 0b00100110); /* rx */ #elif defined UARTD /* set pinmux for uart-d (ouya */ reg_write(PINMUX_BASE, PINMUX_AUX_ULPI_CLK_0, 0b00000110); /* tx */ reg_write(PINMUX_BASE, PINMUX_AUX_ULPI_DIR_0, 0b00100110); /* rx */ #endif` [PreviousAPX Mode (USB Recovery Mode "RCM")chevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging) [NextDump platform key (SBK)chevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads/dump-platform-key-sbk) Last updated 5 years ago Was this helpful? * [Spam UART A TX](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#spam-uart-a-tx) * [ECHO UART RX to TX](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#echo-uart-rx-to-tx) * [Hardware (PinMUX)](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#hardware-pinmux) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # APX Mode (USB Recovery Mode "RCM") | Open Surface RT APX Mode (NVIDIA USB Recovery Mode) can be used to run Fusee Gelee **or** to use Nvidia tools to flash the hardware. [https://forum.xda-developers.com/showpost.php?p=77286176&postcount=85arrow-up-right](https://forum.xda-developers.com/showpost.php?p=77286176&postcount=85) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#entering-apx-mode) Entering APX Mode ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- **Note** - you will need a USB3 port on your development computer. Power off the SurfaceRT or RT2 (not sleep mode!) When the device is shut off, plug in a USB type A into the Surface, and a USB type A (or type C depending on your development device) into your development computer. Hold VOL-UP; Press PWR and release it. Release VOL-UP if `dmesg -Tw` shows: ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MLri-nlF5pGp2Q6e676%252F-MLriUIbP1568YW0URj4%252FRCM.png%3Falt%3Dmedia%26token%3D5fba181a-9e27-4fc6-aec7-2033841efcfb&width=768&dpr=3&quality=100&sign=c4daa9a8&sv=2) Surface RT Once connected in APX mode, you can use NVidia tools or a precompiled Fusee Gelee on your device. Nvflash v2.6 - [https://docs.toradex.com/103464-nvfl...ry-toolset.ziparrow-up-right](https://docs.toradex.com/103464-nvflash-recovery-toolset.zip) NvFlash tool for getting uid - [https://web.archive.org/web/20160318...ools-win32.ziparrow-up-right](https://web.archive.org/web/20160318173203if_/http://www.androidroot.mobi/download/nvflash-tools-win32.zip) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#entering-apx-mode-from-anywhere) Entering APX Mode from anywhere -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Connect USB - A-to-A cable Write 0x00000002 to 0x7000E450 <- sets bit in PMC-register to indicate to boot to RCM Write 0x00000010 to 0x7000E400 <- reboot This should force reset in RCM Mode ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#enter-rcm-from-uefi-shell) Enter RCM from UEFI Shell Boot UEFI Shell as normal. use this startup.nsh [PreviousFusée Geléechevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee) [NextPayloadschevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads) Last updated 4 years ago Was this helpful? * [Entering APX Mode](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#entering-apx-mode) * [Entering APX Mode from anywhere](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#entering-apx-mode-from-anywhere) * [Enter RCM from UEFI Shell](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#enter-rcm-from-uefi-shell) Was this helpful? sun-brightdesktopmoon startup.nsh Copy ### Blink screen to indicate the the script has started mm 0x7000A000 0x8010000E -w 4 stall 1000000 mm 0x7000A000 0x80FF000E -w 4 stall 10000000 # waits 10s; plug in the usb a-a cable in this time # reboot to RCM is usb a-a cable is connected mm 0x7000E450 0x02 -w 4 # Write RCM bit mm 0x7000E400 0x10 -w 4 # reset sun-brightdesktopmoon --- # Fusée Gelée | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee#the-exploit) The Exploit ----------------------------------------------------------------------------------------------------------------------------------------- Fusee Gelee (translates to Frozen Rocket) is a coldboot launcher. The exploit takes advantage of a USB software stack that is provided inside the BootROM. This stack contains a copy operation that allows for control from attackers. By creating your own USB control request, attacks can use this vulnerability to gain control of the Boot and Power Management Processor (BPMP). This allows attackers to gain control of the system before any of privilege restrictions are put in place, essentially giving full access to the device. Allowing for the loading of arbitrary code and extraction of secrets. This vulnerability is completely unpatchable, so the only way to fix this vulnerability is to recall and replace existing SKUs. It affects most of the Tegra devices that were produced before the exploit was published. This includes Surface RT and Surface RT2 and other Tegra3/4 devices. file-pdf 2MB [fusee\_gelee\_nvidia.pdf](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJWXMlq5qDUIVA-scUz%2F-MJWgR-170UMeG47y1kH%2Ffusee_gelee_nvidia.pdf?alt=media&token=1fa98168-b99b-4439-a7ec-24cbbbfbb325) PDF downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJWXMlq5qDUIVA-scUz%2F-MJWgR-170UMeG47y1kH%2Ffusee_gelee_nvidia.pdf?alt=media&token=1fa98168-b99b-4439-a7ec-24cbbbfbb325) https://misc.ktemkin.com/fusee\_gelee\_nvidia.pdf [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee#execute-the-exploit) Execute the Exploit --------------------------------------------------------------------------------------------------------------------------------------------------------- To use this exploit you need * A payload - a binary file which gets executed * A payload sender - a program which transfers the payload to the device memory. * pyusb There is a precompiled payload for the Nexus 7 2012 that we can repurpose for the Surface RT (Tegra 3). [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)GitHub - tofurky/tegra30\_debrick: fusee-gelee payload, supporting files, and guide for debricking Tegra 3 devices (2012 Nexus 7 and Ouya)GitHubchevron-right](https://github.com/tofurky/tegra30_debrick/) The payload provided in this repository has been tested many times, but proceed at your own risk. You will need to clone this repository into a new directory, including the submodule here: [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)GitHub - jevinskie/fusee-launcher: work-in-progress launcher for one of the Tegra X1 bootROM exploits with branches to support T132, T30, and (WIP) T20GitHubchevron-right](https://github.com/jevinskie/fusee-launcher) Once the payload and exploit are downloaded, here are the steps all the way up to flashing an unsigned bootloader: * Connect a USB-A to USB-A cable from your Surface RT to a USB 3.0 port on your host machine. * Boot into APX mode. 1. Press and hold Volume Up & Power for about 3 seconds 2. Release the Power button 3. Release the Volume Up button 4. lsusb should show a Nvidia device with id `0955:7130` * `cd` into the `tegra30_debrick` directory * Run the command`sudo ./fusee-launcher/fusee-launcher.py ./payload/uart_payload_n7.bin -V 0955 -P 7130` * This will send the uart\_payload to the Surface RT, and patch the getSecurityMode function to always return 3, allowing us to use nvflash. * Run the command`sudo ./utils/nvflash_v1.13.87205 --getbct --bct surfacert.bin --configfile ./utils/flash.cfg` * This will read the surfacert bct, which is a required input for many nvflash commands. * Finally, we can run arbitrary code using the following command: * `sudo ./utils/nvflash_v1.13.87205_miniloader_patched --setbct --bct surfacert.bin --configfile ./utils/flash.cfg --bl u-boot.bin --go` Further tweaking is needed to get a functioning bootloader, with the above steps, and the compiled nvidia fork of u-boot located here (Driver Packages - Cardhu), the webcam light turns on. [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fdeveloper.nvidia.com%2Fassets%2Ffavicon-81bff16cada05fcff11e5711f7e6212bdc2e0a32ee57cd640a8cf66c87a6cbe6.ico&width=20&dpr=3&quality=100&sign=2ff82758&sv=2)Linux For Tegra R16NVIDIA Developerchevron-right](https://developer.nvidia.com/linux-tegra-rel-16) Once the L4T R16 u-boot.bin is flashed, you will then need to press and hold the Power button for around 10 seconds to fully power off the tablet. Then you can repeat the above steps to re-attempt flashing. [PreviousTegra SoC'schevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process) [NextAPX Mode (USB Recovery Mode "RCM")chevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging) Last updated 4 years ago Was this helpful? * [The Exploit](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee#the-exploit) * [Execute the Exploit](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee#execute-the-exploit) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Changelog | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/changelog#changelog) Changelog --------------------------------------------------------------------------------------- 24 / Dec / 2021 Removed old installation guide, created a temporary one and moved tablet hardware overlook out from Windows 10 category LY 08 / Dec / 2021 Add prebuilt linux binaries L 04 / Dec / 2021 Add UEFI Privilege Escalation Exploit Documentation after being stuck as draft for months L 29 / Nov / 2021 Update [Rasberry Pi OS installation instructions](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) CTS 20 / Oct / 2021 Added information about prebuilt uboot to APX boot Linux page. L 24 / Sept / 2021 Updated [front page](https://open-rt.gitbook.io/open-surfacert) . Added [Changelog](https://open-rt.gitbook.io/open-surfacert/changelog#changelog) , [Get Started](https://open-rt.gitbook.io/open-surfacert/get-started) CTS, L 24 / Sept / 2021 Merged Linux APX and EFI booting CTS, L 16 / Sep / 2021 Add new Linux prebuilt binaires L 07 / Sep / 2021 Add new Linux prebuilt binaries. They finally support WiFi L 29 / Aug / 2021 Initial Lenovo Ideapad Yoga 11 update. This adds information about Linux L, CTS 27 / Aug / 2021 [FAT32 isn't FAT32](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32) . Tell about the USB drive issue L 27 / Aug / 2021 Removed misleading information for [RPI OS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) . Files on the FAT32 are only required for APX booting L 27 / Aug / 2021 Add information about the [MADT / APIC table](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt) and add usage information for it (ACPI Parking Protocol) L 26 / July / 2021 Rewrite to Surface RT2 specifications tab and moved to [Hardwarearrow-up-right](https://openrt.gitbook.io/open-surfacert/surface-rt2/hardware) LY 10 / July / 2021 Reworked Linux section. EFI booting was moved away from development section L 09 / July / 2021 Updated EFI linux compiling information and added [prebuilt EFI kernels](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) L 09 / July / 2021 Updated main page L 05 / July / 2021 Added [technical tCover information](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid/microsoft-type-touch-cover) CTS 21 / June / 2021 Added [Windows 10 installation guidearrow-up-right](https://openrt.gitbook.io/open-surfacert/common/windows-10/installation-guide) LY 20 / June / 2021 Update [RPI UART setup](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup) L 15 / June / 2021 Updated [ACPI Tables](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables) for sRT CTS 15 / June / 2021 Added [Special Boot modes](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes) CTS 15 / June / 2021 Added [Touch/Type/Power Coversarrow-up-right](https://openrt.gitbook.io/open-surfacert/common/touch-type-power-covers) page NCRC 14 / June / 2021 Updated images on the [battery arrow-up-right](https://openrt.gitbook.io/open-surfacert/surface-rt/hardware/battery) page NCRC 12 / June / 2021 Added [batteryarrow-up-right](https://openrt.gitbook.io/open-surfacert/surface-rt/hardware/battery) info for Surface RT LY 10 / June / 2021 Updated Power Supply Pinout NCRC, L 22 / May / 2021 Added basic information about the [Replay Protected Memory Block (RPMB) on emmc](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/rpmb-partition-on-emmc) L 22 / May / 2021 Added information about an easier way of [applying Yahallo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#quick-explanation-and-multiple-options) and [enabling test signing](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#the-new-method) L 19 / May / 2021 Added information about the Windows RT 8 Update Kit and the Windows 10 Build 15035 Mod Kit L 19 / May / 2021 Uploaded [tool for easy secureboot state change](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) L 18 / May / 2021 Updated [Surface RT2 Specificationsarrow-up-right](https://openrt.gitbook.io/open-surfacert/surface-rt2/hardware/specifications) LY 05 / Apr / 2021 Added a [Yahallo Undo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#undo) L 02 / Apr / 2021 Added instructions for [GDB Debugging](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation/gdb-debugging) qemu and [integrating it into VSCode](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation/gdb-debugging/vscode-integration) L 02 / Apr / 2021 Added [Qemu emulation](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation) instuctions L 02 / Apr / 2021 Added [instructions on booting a Linux distro](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#choosing-a-distro) LY, L 25 / Mar / 2021 Added a [Yahallo guide](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#executing-yahallo-exploit) LY 22 / Feb / 2021 Updated latest SMP progress and corrected EFI linux boot information L 18 / Feb / 2021 Added reference to latest EFI booting progress L 05 / Feb / 2021 Added [a page for what we tried on linux efi boot](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried) L 03 / Feb / 2021 Added latest info about [EFI boot](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting) L 31 / Jan / 2021 Added a writeup about trying to get rid trustzone and uefi 29 / Jan / 2021 Complete revision of Surface RT section CTS 22 / Jan / 2021 Refined [Flash chip pagearrow-up-right](https://app.gitbook.com/@openrt/s/open-surfacert/surface-rt/hardware/components/spi) JB 22 / Jan / 2021 Added [U-Boot log](https://open-rt.gitbook.io/open-surfacert/development/please-read/further-information-1#u-boot-debug-output) L 21 / Jan / 2021 Added Linux Feature list CTS 21 / Jan / 2021 Added [Distros](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros) /[RaspiOS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) & updated [Root filesystem](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem) CTS 02 / Jan / 2021 Added Windows 10 section and a link to a spreadsheet with tested games L 30 / Dec / 2020 Added a temporary [EFI linux booting](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting) page L 04 / Dec / 2020 Moved stuff from the development section to the corresponding pages CTS 30 / Nov / 2020 Added [link to untested recovery images](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#untested-recovery-images-for-other-devices) L 28 / Nov / 2020 Added [Jailbreak Exploits](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits) page LG 27 / Nov / 2020 Added [BCT](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct) L 26 / Nov / 2020 Added [dumping sbk](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads/dump-platform-key-sbk) and added [how to tell that BCT is stored on SPI flash](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#the-dump) L 26 / Nov / 2020 Added [SPI flash](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash) L 26 / Nov / 2020 Added [GPIOs in Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios/gpios-in-linux) L 20 / Nov / 2020 Added [Gpios](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios) CTS 19 / Nov / 2020 Added [Compile Section for SSDT](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#compile-ssdt-0000-asl) L 19 / Nov / 2020 Added the [ACPI Tables](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables) for Surface RT CTS 13 / Nov / 2020 Added notes in [Secure Boot](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot) page regarding development focus LS 11 / Nov / 2020 Added [Boot Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux) and updated all pages in SurfaceRT/Linux CTS 08 / Nov / 2020 Added [uboot bootscript](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#boot-script) CTS 03 / Nov / 2020 Added and cleaned specs information on Surface RT and Surface 2 AF 03 / Nov / 2020 Added PSU page and section LS 31 / Oct / 2020 Added WindRE/WIM Install files and ported over [Recovery Toolkit](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit) page JB, AF 29 / Oct / 2020 Added [Pinmux dump](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/pinmux) CTS 28 / Oct / 2020 Added [UEFI device tree and dh logs](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables) LS, L 25 / Oct / 2020 Added more pdf datasheet links to Hardware Section LS 21 / Oct / 2020 finished [UART](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart) CTS 21 / Oct / 2020 General housekeeping in Development section LS 21 / Oct / 2020 Frontpage -> updated project status CTS 21 / Oct / 2020 SurfaceRT -> added Linux section (devicetree, uboot, kernel, rootFS) CTS 21 / Oct / 2020 SurfaceRT/Hardware -> cleaned / added i2c findings CTS 20 / Oct / 2020 Updated status - Linux is booting on the SurfaceRT over serial LS, CTS 20 / Oct / 2020 Added Hardware Chipsets in [Hardware Specifications Page for SurfaceRT](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware) LS 20 / Oct / 2020 Added updated Kernel config parameters in Kernel dev page LS 19 / Oct / 2020 Added Kernel Log for Partial Boot. Serious progress was made today! LS, CTS 19 / Oct / 2020 Added TX / RX pins to [UART](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#uart-a) page LS, CTS 19 / Oct / 2020 Added link to NVIDIA CBT tools on [BCT Table Page](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/bct-table) LS 19 / Oct / 2020 Updated Home Page to have changelog and project status LS 19 / Oct / 2020 Updated Kernel page to note standard vs EFI kernel compilation LS 19 / Oct / 2020 Updated u-Boot page to note successful serial output from u-Boot, and updated instructions LS 16 / Oct / 2020 Added Tegra SoC Boot Process, initial uBoot pages LS 13 / Oct / 2020 Added Kernel compilation notes LS 12 / Oct / 2020 Added initial content and notes LS, CTS, JB #### [hashtag](https://open-rt.gitbook.io/open-surfacert/changelog#shortcuts) Shortcuts abbreviation nickname AF Alexenferman CTS CrackTheSurface JB Jukebox L Leander LG lgibson02 LS Loz LY LeYuuki NCRC NeonCatRC [PreviousLinuxchevron-left](https://open-rt.gitbook.io/open-surfacert/get-started/linux) [NextBoot Processchevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UEFI | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MLgky0OwVaidO-X5XBN%252F-MLhL0vRqGSEQ6msxEZ5%252FtestOut.bmp%3Falt%3Dmedia%26token%3D26153638-fd04-4bf2-b1dd-3b5f61b4c930&width=768&dpr=3&quality=100&sign=5ba855fd&sv=2) Original Boot Graphic from SurfaceRT UEFI Firmware is loaded by the [BootRom](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process#how-the-bootrom-works) which loads the UEFI Firmware. UEFI Firmware will setup hardware like Display, USB, etc. After hardware setup it will transfer control to `/efi/boot/bootarm.efi` bootarm.efi has to be signed with the Microsoft SecureBootKey (SBK) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi#notes) Notes ----------------------------------------------------------------------------------------------- [https://forum.xda-developers.com/showpost.php?p=82555449&postcount=126arrow-up-right](https://forum.xda-developers.com/showpost.php?p=82555449&postcount=126) [coherixmattsarrow-up-right](https://forum.xda-developers.com/windows-8-rt/rt-development/wip-secure-boot-linux-surface-rt-t3653848/member.php?u=10784299) - "This has been helpful to me, as I was able to quickly test changes to the BCD file. Changing the BCD file allowed me to replace test.efi with bootshim.efi from here: [http://github.com/imbushuo/boot-shim/releasesarrow-up-right](http://github.com/imbushuo/boot-shim/releases) Instead of loading EFI files like test.efi, this alternative loads ELF files. That isn't necessarily so exciting, but this BootShim also unloads elements of the original SecureBoot restricted UEFI. They are using this on Lumia devices (particularly the 950XL) to load a modified version of UEFI. After that, it seems they can boot most anything." This thread also seems interesting for reference [https://github.com/rhboot/shim/issues/138arrow-up-right](https://github.com/rhboot/shim/issues/138) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi#bugs) Bugs --------------------------------------------------------------------------------------------- In the Surface RT UEFI there is a bug which prevents the display from working. This is because the standard GOP (Graphical Ouput Protocol) isn't hooked up to the Surface RT's display. This was fixed in the Surface RT 2. [PreviousDump platform key (SBK)chevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads/dump-platform-key-sbk) [NextSecure Bootchevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot) Last updated 4 years ago Was this helpful? * [Notes](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi#notes) * [Bugs](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi#bugs) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Secure Boot | Open Surface RT UEFI can be set to require a trusted chain from boot to execution of OS - aka a [Root of Trust](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#root-of-trust) . On the Surface RT/2, UEFI is setup to require a trusted chain "secure boot". This was the main issue for development of other OS's on the Surface RT/2 hardware. Secure Boot means that we are unable to replace the "bootarm.efi" bootloader with our own bootloader like GRUB as it needs to be signed by Microsoft. Microsoft is unwilling or unable to provide the key to "unlock" the Surface RT/2 hardware, so we are "stuck" with using their bootloader. There are two possible options to bypass this - [Yahallo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot) and [Test Certificate](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#test-certificate) bypass. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#test-certificate) Test Certificate --------------------------------------------------------------------------------------------------------------------------------- A "golden key" bypass which allows us to insert a trusted test certificate into the UEFI Bios allows us to use a signed shim to boot into our own EFI loader (instead of booting into Windows). We still load Microsoft's signed bootarm.efi, which then loads a shim, to load Grub/EFI shell, which can then finally load a Kernel. Further info on this [bootmanager exploit bypass is here](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/windows-bootmanager-exploit) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#enabling-test-signing) Enabling test signing #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#the-new-method) The new method A new, easier method for enabling test signing was discovered. It involves the same techniques, but you only need to boot from a USB twice, you don't even need a windows installed. (An EFI partition could be required, this needs to be verified) Grab the ZIP file from [here](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb#download) , extract it to your USB, and boot your Surface device from it. A menu should show up where you have several options (Install Golden Keys, Uninstall Golden Keys, Apply Yahallo, Undo Yahallo). Select "Install Golden Keys" to enable test signing (You have to use a USB keyboard to select an entry). Your device should reboot and you need to accept a warning. With this you can also easily disable secure boot with the help of yahallo. Just make sure test signing is enabled and you can select "Apply Yahallo" in the menu to disable secure boot. You can get further explanation of the tool / USB setup in the [development section](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) . #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#the-original-method) The original method circle-info Original Source: [https://forum.xda-developers.com/windows-8-rt/rt-development/wip-secure-boot-linux-surface-rt-t3653848arrow-up-right](https://forum.xda-developers.com/windows-8-rt/rt-development/wip-secure-boot-linux-surface-rt-t3653848) Note: This only works when you downgraded to Windows RT 8.0 you can brick your device if you use Windows RT 8.1. Down in this section there is a download for the "golden key" you need to install it, by running InstallPolicy.cmd as admininistrator on your SurfaceRT. It is important that you don't run the file off a USB drive, copy it to your desktop. After running the file you need to reboot, a menu should open which should enable you to enable testsigning. Accept it. After the reboot open up a cmd, again with administrator privilegs and run the following command: Reboot again, now testsigning should be enabled. file-archive 389KB [SecureBoot.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJSNdEkZ6AW01ZvVuF8%2F-MJSOh0vX3UEQ8kL9nSZ%2FSecureBoot.zip?alt=media&token=01c90666-bda6-435c-bf1f-65db6ae6177b) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJSNdEkZ6AW01ZvVuF8%2F-MJSOh0vX3UEQ8kL9nSZ%2FSecureBoot.zip?alt=media&token=01c90666-bda6-435c-bf1f-65db6ae6177b) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#using-test-signing-to-boot-files-from-usb) Using test signing to boot files from USB To use the test signing to boot from USB you need to extract the files from the usb-boot-setup.zip to the root of a FAT32 formated USB-drive. This setup doesn't include any bootable files, to add one place it into the root directory and name it BOOT.efi. Further reading on how the bootflow works at [UEFI Boot Sequence](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/uefi-boot-sequence) . file-archive 541KB [usb-boot-setup.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJSRbRJp59PpvW51pSv%2F-MJSTFrGFoTm5XTtYz-S%2Fusb-boot-setup.zip?alt=media&token=5085ca15-15fe-4a6a-a471-2b6d6968b36d) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJSRbRJp59PpvW51pSv%2F-MJSTFrGFoTm5XTtYz-S%2Fusb-boot-setup.zip?alt=media&token=5085ca15-15fe-4a6a-a471-2b6d6968b36d) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#root-of-trust) Root of Trust --------------------------------------------------------------------------------------------------------------------------- Root of Trust combination with keys and certificates. Using SecureBoot your firmware will check if the operating system you are trying to boot and your bootloader are trusted by you. On each boot-up UEFI firmware will inspect what you are trying to boot and if it's not trusted a security violation will be triggered. PK: The Platform Key, the master one, the ring to rule them all. The holder of a PK can install a new PK and update the KEK. KEK: Key Exchange Key is a secondary key used to sign EFI executables directly or a key used to sign the db and dbx databases. db: The signature databse is a list with all allowed signing certificates or criptografy hashes to allowed binaries. We will use THIS db key to sign our Linux Kernel. dbx: The dark side of the db. Inverse db. "not-good-db". You name it. It's the list containing all keys that are not allowed. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#further-reading) Further Reading ------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#secure-boot-efi) Secure boot /EFI [https://news.knowledia.com/US/en/articles/secure-your-boot-process-uefi-secureboot-efistub-luks2-lvm-2fe5ab6e432ac7b6d0bb773cebe0363c41bef83carrow-up-right](https://news.knowledia.com/US/en/articles/secure-your-boot-process-uefi-secureboot-efistub-luks2-lvm-2fe5ab6e432ac7b6d0bb773cebe0363c41bef83c) [https://wiki.ubuntu.com/UEFI/SecureBoot/Signingarrow-up-right](https://wiki.ubuntu.com/UEFI/SecureBoot/Signing) [https://bentley.link/secureboot/arrow-up-right](https://bentley.link/secureboot/) [https://ruderich.org/simon/notes/secure-boot-with-grub-and-signed-linux-and-initrdarrow-up-right](https://ruderich.org/simon/notes/secure-boot-with-grub-and-signed-linux-and-initrd) [https://lwn.net/Articles/632528/arrow-up-right](https://lwn.net/Articles/632528/) \[The bootstrap process on EFI systems\] [https://community.arm.com/developer/ip-products/system/f/embedded-forum/7016/uefi-on-arm-v8-based-linux-embedded-systemarrow-up-right](https://community.arm.com/developer/ip-products/system/f/embedded-forum/7016/uefi-on-arm-v8-based-linux-embedded-system) [https://www.rodsbooks.com/efi-bootloaders/controlling-sb.htmlarrow-up-right](https://www.rodsbooks.com/efi-bootloaders/controlling-sb.html) [http://weng-blog.com/2017/07/21/ARMv8-UEFI-manual-boot.htmlarrow-up-right](http://weng-blog.com/2017/07/21/ARMv8-UEFI-manual-boot.html) [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fblog.hansenpartnership.com%2Fwp-uploads%2F2020%2F05%2Fhansen.svg&width=20&dpr=3&quality=100&sign=328a637c&sv=2)Owning your Windows 8 UEFI PlatformJames Bottomley's random Pageschevron-right](https://blog.hansenpartnership.com/owning-your-windows-8-uefi-platform/) [https://ubuntu.com/blog/how-to-sign-things-for-secure-bootarrow-up-right](https://ubuntu.com/blog/how-to-sign-things-for-secure-boot) [https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s\_EFI\_Install\_Guide/Configuring\_Secure\_Bootarrow-up-right](https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot) [PreviousUEFIchevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi) [NextWindows Bootmanager Exploitchevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/windows-bootmanager-exploit) Last updated 4 years ago Was this helpful? * [Test Certificate](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#test-certificate) * [Enabling test signing](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#enabling-test-signing) * [Using test signing to boot files from USB](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#using-test-signing-to-boot-files-from-usb) * [Root of Trust](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#root-of-trust) * [Further Reading](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#further-reading) * [Secure boot /EFI](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#secure-boot-efi) Was this helpful? sun-brightdesktopmoon Copy bcdedit /set {default} testsigning on && bcdedit /set {bootmgr} testsigning on sun-brightdesktopmoon --- # Windows Bootmanager Exploit | Open Surface RT [Secure Golden Key Boot: (MS16-094 / CVE-2016-3287, and MS16-100 / CVE-2016-3320)web.archive.orgchevron-right](https://web.archive.org/web/20170604013028/https://rol.im/securegoldenkeyboot/) Copy | | | a w r i t e u p r e l e a s e b y r o l | | ________ ___ ________ ________ | | <_ __ \/ \/ \/ ____ \ | | T T<___/\___/\_ /\ _/\ \__j _/ | | | | T T T / \ T__\____ T | | | | | | | \ / |T T T | | | l__j_____l___j_l__><__j| | | | | | T _______ T | ___j | l___j | | | | T __T |_j l_______l________j | | | | l_| |__ _______j | | | l_____j | T T | ____ ' __l_________j_| |___ ` ________ T T ___ / ____ TT __Tj | T _/\_ ____/\_ / ____ T | | / \\ \__j || l____j | _/ \_/ \ \_ \ \__j | | |_\___/_\____ || l__| l___T /\ T___/ /\ T__\____ | | | TT T T T || _ | ___j| / \ | T / \ |T T T | | l || | l___j || | | l___| \ / | | \ / || l___j | l____jl__l________jl___l___j______j__><__j__j__><__jl________j r i n g o f l i g h t n i n g irc.rol.im #rtchurch :: https://rol.im/chat/rtchurch Specific Secure Boot policies, when provisioned, allow for testsigning to be enabled, on any BCD object, including {bootmgr}. This also removes the NT loader options blacklist (AFAIK). (MS16-094 / CVE-2016-3287, and MS16-100 / CVE-2016-3320) Found by my123 (@never_released) and slipstream (@TheWack0lian) Writeup by slipstream (@TheWack0lian) First up, "Secure Boot policies". What are they exactly? As you know, secureboot is a part of the uefi firmware, when enabled, it only lets stuff run that's signed by a cert in db, and whose hash is not in dbx (revoked). As you probably also know, there are devices where secure boot can NOT be disabled by the user (Windows RT, HoloLens, Windows Phone, maybe Surface Hub, and maybe some IoTCore devices if such things actually exist -- not talking about the boards themselves which are not locked down at all by default, but end devices sold that may have secureboot locked on). But in some cases, the "shape" of secure boot needs to change a bit. For example in development, engineering, refurbishment, running flightsigned stuff (as of win10) etc. How to do that, with devices where secure boot is locked on? Enter the Secure Boot policy. It's a file in a binary format that's embedded within an ASN.1 blob, that is signed. It's loaded by bootmgr REALLY early into the windows boot process. It must be signed by a certificate in db. It gets loaded from a UEFI variable in the secureboot namespace (therefore, it can only be touched by boot services). There's a couple .efis signed by MS that can provision such a policy, that is, set the UEFI variable with its contents being the policy. What can policies do, you ask? They have two different types of rules. BCD rules, which override settings in the on-disk BCD, and registry rules, which contain configuration for the policy itself, plus configuration for other parts of boot services, etc. For example, one registry element was introduced in Windows 10 version 1607 'Redstone' which disables certificate expiry checking inside mobilestartup's .ffu flashing (ie, the "lightning bolt" windows phone flasher); and another one enables mobilestartup's USB mass storage mode. Other interesting registry rules change the shape of Code Integrity, ie, for a certain type of binary, it changes the certificates considered valid for that specific binary. (Alex Ionescu wrote a blog post that touches on Secure Boot policies. He teased a followup post that would be all about them, but that never came.) But, they must be signed by a cert in db. That is to say, Microsoft. Also, there is such a thing called DeviceID. It's the first 64 bits of a salted SHA-256 hash, of some UEFI PRNG output. It's used when applying policies on Windows Phone, and on Windows RT (mobilestartup sets it on Phone, and SecureBootDebug.efi when that's launched for the first time on RT). On Phone, the policy must be located in a specific place on EFIESP partition with the filename including the hex-form of the DeviceID. (With Redstone, this got changed to UnlockID, which is set by bootmgr, and is just the raw UEFI PRNG output.) Basically, bootmgr checks the policy when it loads, if it includes a DeviceID, which doesn't match the DeviceID of the device that bootmgr is running on, the policy will fail to load. Any policy that allows for enabling testsigning (MS calls these Retail Device Unlock / RDU policies, and to install them is unlocking a device), is supposed to be locked to a DeviceID (UnlockID on Redstone and above). Indeed, I have several policies (signed by the Windows Phone production certificate) like this, where the only differences are the included DeviceID, and the signature. If there is no valid policy installed, bootmgr falls back to using a default policy located in its resources. This policy is the one which blocks enabling testsigning, etc, using BCD rules. Now, for Microsoft's screwups. During the development of Windows 10 v1607 'Redstone', MS added a new type of secure boot policy. Namely, "supplemental" policies that are located in the EFIESP partition (rather than in a UEFI variable), and have their settings merged in, dependant on conditions (namely, that a certain "activation" policy is also in existance, and has been loaded in). Redstone's bootmgr.efi loads "legacy" policies (namely, a policy from UEFI variables) first. At a certain time in redstone dev, it did not do any further checks beyond signature / deviceID checks. (This has now changed, but see how the change is stupid) After loading the "legacy" policy, or a base policy from EFIESP partition, it then loads, checks and merges in the supplemental policies. See the issue here? If not, let me spell it out to you plain and clear. The "supplemental" policy contains new elements, for the merging conditions. These conditions are (well, at one time) unchecked by bootmgr when loading a legacy policy. And bootmgr of win10 v1511 and earlier certainly doesn't know about them. To those bootmgrs, it has just loaded in a perfectly valid, signed policy. The "supplemental" policy does NOT contain a DeviceID. And, because they were meant to be merged into a base policy, they don't contain any BCD rules either, which means that if they are loaded, you can enable testsigning. Not just for windows (to load unsigned driver, ie rootkit), but for the {bootmgr} element as well, which allows bootmgr to run what is effectively an unsigned .efi (ie bootkit)!!! (In practise, the .efi file must be signed, but it can be self-signed) You can see how this is very bad!! A backdoor, which MS put in to secure boot because they decided to not let the user turn it off in certain devices, allows for secure boot to be disabled everywhere! You can see the irony. Also the irony in that MS themselves provided us several nice "golden keys" (as the FBI would say ;) for us to use for that purpose :) About the FBI: are you reading this? If you are, then this is a perfect real world example about why your idea of backdooring cryptosystems with a "secure golden key" is very bad! Smarter people than me have been telling this to you for so long, it seems you have your fingers in your ears. You seriously don't understand still? Microsoft implemented a "secure golden key" system. And the golden keys got released from MS own stupidity. Now, what happens if you tell everyone to make a "secure golden key" system? Hopefully you can add 2+2... Anyway, enough about that little rant, wanted to add that to a writeup ever since this stuff was found ;) Anyway, MS's first patch attempt. I say "attempt" because it surely doesn't do anything useful. It blacklists (in boot.stl), most (not all!) of the policies. Now, about boot.stl. It's a file that gets cloned to a UEFI variable only boot services can touch, and only when the boot.stl signing time is later than the time this UEFI variable was set. However, this is done AFTER a secure boot policy gets loaded. Redstone's bootmgr has extra code to use the boot.stl in the UEFI variable to check policy revocation, but the bootmgrs of TH2 and earlier does NOT have such code. So, an attacker can just replace a later bootmgr with an earlier one. Another thing: I saw some additional code in the load-legacy-policy function in redstone 14381.rs1_release. Code that wasn't there in 14361. Code that specifically checked the policy being loaded for an element that meant this was a supplemental policy, and erroring out if so. So, if a system is running Windows 10 version 1607 or above, an attacker MUST replace bootmgr with an earlier one. On August 9th, 2016, another patch came about, this one was given the designation MS16-100 and CVE-2016-3320. This one updates dbx. The advisory says it revokes bootmgrs. The dbx update seems to add these SHA256 hashes (unless I screwed up my parsing): 075eea060589548ba060b2feed10da3c20c7fe9b17cd026b94e8a683b8115238 07e6c6a858646fb1efc67903fe28b116011f2367fe92e6be2b36999eff39d09e 09df5f4e511208ec78b96d12d08125fdb603868de39f6f72927852599b659c26 0bbb4392daac7ab89b30a4ac657531b97bfaab04f90b0dafe5f9b6eb90a06374 0c189339762df336ab3dd006a463df715a39cfb0f492465c600e6c6bd7bd898c 0d0dbeca6f29eca06f331a7d72e4884b12097fb348983a2a14a0d73f4f10140f 0dc9f3fb99962148c3ca833632758d3ed4fc8d0b0007b95b31e6528f2acd5bfc 106faceacfecfd4e303b74f480a08098e2d0802b936f8ec774ce21f31686689c 174e3a0b5b43c6a607bbd3404f05341e3dcf396267ce94f8b50e2e23a9da920c 18333429ff0562ed9f97033e1148dceee52dbe2e496d5410b5cfd6c864d2d10f 2b99cf26422e92fe365fbf4bc30d27086c9ee14b7a6fff44fb2f6b9001699939 2bbf2ca7b8f1d91f27ee52b6fb2a5dd049b85a2b9b529c5d6662068104b055f8 2c73d93325ba6dcbe589d4a4c63c5b935559ef92fbf050ed50c4e2085206f17d 2e70916786a6f773511fa7181fab0f1d70b557c6322ea923b2a8d3b92b51af7d 306628fa5477305728ba4a467de7d0387a54f569d3769fce5e75ec89d28d1593 3608edbaf5ad0f41a414a1777abf2faf5e670334675ec3995e6935829e0caad2 3841d221368d1583d75c0a02e62160394d6c4e0a6760b6f607b90362bc855b02 3fce9b9fdf3ef09d5452b0f95ee481c2b7f06d743a737971558e70136ace3e73 4397daca839e7f63077cb50c92df43bc2d2fb2a8f59f26fc7a0e4bd4d9751692 47cc086127e2069a86e03a6bef2cd410f8c55a6d6bdb362168c31b2ce32a5adf 518831fe7382b514d03e15c621228b8ab65479bd0cbfa3c5c1d0f48d9c306135 5ae949ea8855eb93e439dbc65bda2e42852c2fdf6789fa146736e3c3410f2b5c 6b1d138078e4418aa68deb7bb35e066092cf479eeb8ce4cd12e7d072ccb42f66 6c8854478dd559e29351b826c06cb8bfef2b94ad3538358772d193f82ed1ca11 6f1428ff71c9db0ed5af1f2e7bbfcbab647cc265ddf5b293cdb626f50a3a785e 71f2906fd222497e54a34662ab2497fcc81020770ff51368e9e3d9bfcbfd6375 726b3eb654046a30f3f83d9b96ce03f670e9a806d1708a0371e62dc49d2c23c1 72e0bd1867cf5d9d56ab158adf3bddbc82bf32a8d8aa1d8c5e2f6df29428d6d8 7827af99362cfaf0717dade4b1bfe0438ad171c15addc248b75bf8caa44bb2c5 81a8b965bb84d3876b9429a95481cc955318cfaa1412d808c8a33bfd33fff0e4 82db3bceb4f60843ce9d97c3d187cd9b5941cd3de8100e586f2bda5637575f67 895a9785f617ca1d7ed44fc1a1470b71f3f1223862d9ff9dcc3ae2df92163daf 8ad64859f195b5f58dafaa940b6a6167acd67a886e8f469364177221c55945b9 8bf434b49e00ccf71502a2cd900865cb01ec3b3da03c35be505fdf7bd563f521 8d8ea289cfe70a1c07ab7365cb28ee51edd33cf2506de888fbadd60ebf80481c 9998d363c491be16bd74ba10b94d9291001611736fdca643a36664bc0f315a42 9e4a69173161682e55fde8fef560eb88ec1ffedcaf04001f66c0caf707b2b734 a6b5151f3655d3a2af0d472759796be4a4200e5495a7d869754c4848857408a7 a7f32f508d4eb0fead9a087ef94ed1ba0aec5de6f7ef6ff0a62b93bedf5d458d ad6826e1946d26d3eaf3685c88d97d85de3b4dcb3d0ee2ae81c70560d13c5720 aeebae3151271273ed95aa2e671139ed31a98567303a332298f83709a9d55aa1 afe2030afb7d2cda13f9fa333a02e34f6751afec11b010dbcd441fdf4c4002b3 b54f1ee636631fad68058d3b0937031ac1b90ccb17062a391cca68afdbe40d55 b8f078d983a24ac433216393883514cd932c33af18e7dd70884c8235f4275736 b97a0889059c035ff1d54b6db53b11b9766668d9f955247c028b2837d7a04cd9 bc87a668e81966489cb508ee805183c19e6acd24cf17799ca062d2e384da0ea7 c409bdac4775add8db92aa22b5b718fb8c94a1462c1fe9a416b95d8a3388c2fc c617c1a8b1ee2a811c28b5a81b4c83d7c98b5b0c27281d610207ebe692c2967f c90f336617b8e7f983975413c997f10b73eb267fd8a10cb9e3bdbfc667abdb8b cb6b858b40d3a098765815b592c1514a49604fafd60819da88d7a76e9778fef7 ce3bfabe59d67ce8ac8dfd4a16f7c43ef9c224513fbc655957d735fa29f540ce d8cbeb9735f5672b367e4f96cdc74969615d17074ae96c724d42ce0216f8f3fa e92c22eb3b5642d65c1ec2caf247d2594738eebb7fb3841a44956f59e2b0d1fa fddd6e3d29ea84c7743dad4a1bdbc700b5fec1b391f932409086acc71dd6dbd8 fe63a84f782cc9d3fcf2ccf9fc11fbd03760878758d26285ed12669bdc6e6d01 fecfb232d12e994b6d485d2c7167728aa5525984ad5ca61e7516221f079a1436 ca171d614a8d7e121c93948cd0fe55d39981f9d11aa96e03450a415227c2c65b 55b99b0de53dbcfe485aa9c737cf3fb616ef3d91fab599aa7cab19eda763b5ba 77dd190fa30d88ff5e3b011a0ae61e6209780c130b535ecb87e6f0888a0b6b2f c83cb13922ad99f560744675dd37cc94dcad5a1fcba6472fee341171d939e884 3b0287533e0cc3d0ec1aa823cbf0a941aad8721579d1c499802dd1c3a636b8a9 939aeef4f5fa51e23340c3f2e49048ce8872526afdf752c3a7f3a3f2bc9f6049 64575bd912789a2e14ad56f6341f52af6bf80cf94400785975e9f04e2d64d745 45c7c8ae750acfbb48fc37527d6412dd644daed8913ccd8a24c94d856967df8e I checked the hash in the signature of several bootmgrs of several architectures against this list, and found no matches. So either this revokes many "obscure" bootmgrs and bootmgfws, or I'm checking the wrong hash. Either way, it'd be impossible in practise for MS to revoke every bootmgr earlier than a certain point, as they'd break install media, recovery partitions, backups, etc. - RoL disclosure timeline: ~march-april 2016 - found initial policy, contacted MSRC ~april 2016 - MSRC reply: wontfix, started analysis and reversing, working on almost-silent (3 reboots needed) PoC for possible emfcamp demonstration ~june-july 2016 - MSRC reply again, finally realising: bug bounty awarded july 2016 - initial fix - fix analysed, deemed inadequate. reversed later rs1 bootmgr, noticed additional inadequate mitigation august 2016 - mini-talk about the issue at emfcamp, second fix, full writeup release credits: my123 (@never_released) -- found initial policy set, tested on surface rt slipstream (@TheWack0lian) -- analysis of policies, reversing bootmgr/ mobilestartup/etc, found even more policies, this writeup. tiny-tro credits: code and design: slipstream/RoL font: dMG/Up Rough & Divine Stylers awesome chiptune: bzl/cRO <3 [PreviousSecure Bootchevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot) [NextYahallo - Disable Securebootchevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Fake Builds | Open Surface RT Following the leak of this build to BetaArchive, two pre-prepared images have been distributed for Surface devices in both Chinese and English languages. * An image released in January 2020 has had its Edition modified to Windows RT 10 and Version increased to 1703 whilst retaining the original build number. * A highly modified image based on this build was released in May 2020 which has had its build number modified to 17763, while this image does contain components from later builds likely obtained from Windows PE it is in fact still build 15035. [Windows 10 build 15035arrow-up-right](https://betawiki.net/wiki/Windows_10_build_15035) by [BetaWikiarrow-up-right](https://betawiki.net/) , used under [CC BYarrow-up-right](https://creativecommons.org/licenses/by-sa/4.0/) / Desaturated from original [PreviousSoftware Supportchevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software) [NextKnown Issueschevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues) Last updated 2 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Windows RT | Open Surface RT Further development of Windows RT has been abandoned on the Surface RT/2 devices, which means that many devices are lingering away unused in drawers around the world, waiting for new life. The hardware in the Surface RT/2 is still quite acceptable to be used as a tablet even many years after they were abandoned by Microsoft. For those interested in Windows RT on the Surface RT/2 a newer Windows 10 build can be installed. Instructions for updating a Surface RT/2 to Windows 10\* or RT 8.0/8.1 can be found here - [https://windows-rt-devices.gitbook.io/windows/tools/windows-media-builderarrow-up-right](https://windows-rt-devices.gitbook.io/windows/tools/windows-media-builder) \*NOTE! No this will not install a full x86 build! [PreviousFAT32 isn't FAT32chevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32) [NextJailbreak Exploitschevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits) Last updated 2 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Jailbreak Exploits | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits#restrictions) Restrictions ------------------------------------------------------------------------------------------------------------------------ If you've used Windows RT for any length of time you have probably already realized that trying to run a traditional Windows executable is not possible under a stock configuration. If you do try and run one you will probably see a message like the following. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MNFZCfOZsPACx09phQs%252F-MNFgcYZ7RMFflvwvIrP%252Fnonarm.PNG%3Falt%3Dmedia%26token%3Dd84109ce-02d0-400e-9dc8-ff8df187900b&width=768&dpr=3&quality=100&sign=243ea21b&sv=2) There are two reasons why this happens. The first reason is that Windows RT uses a completely different type of CPU architecture to the one used on standard Windows. Rather than using the x86/x64 from Intel or AMD, Windows RT instead uses the 32-bit ARMv7 architecture. So since almost every Windows executable on the internet is compiled for x86/x64 so do they all fail to work under Windows RT. This may arguably have been trivial for software developers to solve were it not for the next major problem. If you do get your hands on an ARMv7 compiled executable and try to run it, you will see something like the next following message. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MNFZCfOZsPACx09phQs%252F-MNFfPCg9rn1QTSiLisR%252Fdigitalsig.PNG%3Falt%3Dmedia%26token%3Daf2a31dd-1a74-42ba-9c45-e21c8bb953b6&width=768&dpr=3&quality=100&sign=242e6ea6&sv=2) This is what killed Windows RT. This is caused by another difference Windows RT has to standard Windows which is what is called the minimum signing level. This level is set in the kernel and cannot be changed as far as we know. It goes like this: # Level Description 0 Unsigned This is the value found on standard Windows machines. It allows any executable to be ran. 4 Authenticode Would only allow for an executable to be ran if it were signed by a verified publisher. You could not run applications with a "Unknown Publisher". 8 Microsoft This is what Windows RT is set to. Only code signed to run by Microsoft is able to be ran by a user. 12 Windows Would lock any executable from running except those included with the Windows install. Allowing only for Microsoft code to run in the context of Win32 completely cut off any third party support for the system in this area. Third party developers were instead expected to write their software for the Windows Store. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits#exploits) Exploits ---------------------------------------------------------------------------------------------------------------- Over the years there have been a couple of exploits for bypassing the aforementioned signing requirement. Since all are quite vaguely named, I shall refer to them only by their author. Here are all known exploits... Exploit Date Description [netham45's RT Jailbreak Toolarrow-up-right](https://forum.xda-developers.com/showthread.php?t=2092158) January 10 2013 The earliest known exploit. Works by using Windows Symbolic Debugger (`cdb.exe`) to change the minimum signing level loaded in RAM. Requires two minute system up time to work properly and may sometimes cause a BSOD. [Myriachan's Jailbreakarrow-up-right](https://forum.xda-developers.com/windows-8-rt/rt-development/jailbreak-exploit-released-t3225051) October 14 2015 `bcdedit /set '{current}' loadoptions '/TŅSTSIGNING'` enables test signing mode. Works around `/testsigning` option being blocked because blocked options are checked for before they are passed to `ntoskernel.exe.` Once passed `ntoskernel.exe` truncates unicode down to 8-bits and `Ņ` becomes `E.` [PreviousWindows RTchevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-rt) [NextRecovery Toolkitchevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit) Last updated 2 years ago Was this helpful? * [Restrictions](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits#restrictions) * [Exploits](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits#exploits) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Known Issues | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#bugs) Bugs -------------------------------------------------------------------------------------------------- Windows 10 Build 15035 contains a few notable bugs: * The User Account Control user interface is broken, leading to issues starting programs requiring administrative privileges. Disabling UAC using the registry is mandatory to run these programs, this can be achieved by applying the registry entry below: Copy Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=dword:00000000 * Cameras will not work even with the appropriate app and drivers installed due a missing registry entry, this can be resolved by applying the registry entry below: Copy Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Foundation\Platform] "EnableFrameServerMode"=dword:00000000 * Using Microsoft Management Console (MMC) snap-ins can cause a BSOD error (PANIC\_STACK\_SWITCH). This issue occurs most commonly with Event Viewer and Task Scheduler while occurring somewhat less frequently with Disk Management however it may manifest at random with any MMC snap-in. * The Screen Brightness setting does not persist after a reboot and Automatic Brightness does not always function correctly. * Night Mode does not function correctly. * The background colour for windows is gray instead of white. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#driver-compatibility) Driver compatibility ---------------------------------------------------------------------------------------------------------------------------------- This build is for the most part compatible with drivers originally intended for Windows RT aside from the following exceptions: * This build technically does not support NVIDIA Tegra processors, like the ones found in the Surface RT and Surface RT 2. The sdbus driver, responsible for providing an interface layer with the eMMC dropped support for the NVIDIA storage controller during Windows 10 development. You can however replace the driver with the one from Windows RT 8.1 build 9600.16384 to make the build boot on Surface tablets. On the Surface RT 2 (may also apply to Surface RT), using a version of sdbus newer than 9600.16384 will conflict with the nvpep driver causing a BSOD error (IRQL\_NOT\_LESS\_OR\_EQUAL) on boot. Later versions of the Surface RT 2 USB recovery media in particular may contain version 9600.16497 of sdbus driver which will trigger the error. * This build does not support legacy touch drivers built for Windows 8 RTM. Loading these drivers will cause the OS to register touch inputs in the top left corner of the screen. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#expired-digital-signatures) Expired digital signatures ---------------------------------------------------------------------------------------------------------------------------------------------- Numerous issues are caused when attempting to use this build beyond its expiry date due to various digital signatures being outside of the validity period, this is normal and is by design once the build reaches its expiry date or when installed after it. Examples of some of the issues caused by installing or running this build with current date set are listed below. * The legacy Windows Defender UI (MSASCui.exe) is not functional and will terminate with a critical error (0x800b0101). * The Diagnostics Troubleshooting Wizard is not functional and will terminate with a critical error (0x800b0101). * Neither Microsoft Print To PDF or Microsoft XPS Document Writer will be available after installation. Should these be required both drivers can be manually installed from `\Windows\System32\spool\tools` and overriding the Driver Signature Enforcement Check when prompted. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#restrictions) Restrictions ------------------------------------------------------------------------------------------------------------------ Although it is not an edition of Windows RT, this build has inherited some of the restrictions present in Windows RT. When certain Windows RT restrictions were established they were applied not by SKU but were instead applied to a specific architecture, in this case ARM (ARMv7). Issues known to be caused by this are: * User defined start-up programs are not available. * Incoming Remote Desktop connections are not available. [Windows 10 build 15035arrow-up-right](https://betawiki.net/wiki/Windows_10_build_15035) by [BetaWikiarrow-up-right](https://betawiki.net/) , used under [CC BYarrow-up-right](https://creativecommons.org/licenses/by-sa/4.0/) / Desaturated from original [PreviousFake Buildschevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-10/fake-builds-and-customized-releases) [NextLinuxchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux) Last updated 5 years ago Was this helpful? * [Bugs](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#bugs) * [Driver compatibility](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#driver-compatibility) * [Expired digital signatures](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#expired-digital-signatures) * [Restrictions](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues#restrictions) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UEFI Boot Sequence | Open Surface RT According to [the UEFI specarrow-up-right](https://uefi.org/sites/default/files/resources/UEFI_Spec_2_8_final.pdf) a device will initially start up and look for a particular file based on the architecture of the system: As we need to bypass the standard boot, we use the jailbreak to hack the process using a supplemental policy, which enables testsignmode. The CPU will load the boot setup, and then load up UEFI "bios". UEFI will then load /efi/boot/bootarm.efi (which needs to be signed with a secureboot-key) into ram and pass it control to then load other stuff in turn. We haven't been able to sign our own stuff yet ( if we could then we could just install uboot and bypass all the pain!). So.. we use Microsoft's, aka WindowsBootManager (/efi/boot/bootarm.efi) to eventually load our boot tool (i.e. grub2) Microsoft's bootarm.efi checks for efi/microsoft/boot/bcd (boot configuration data) (which then loads our special "jailbreak" policy), then loads a test.efi shim, which finally loads a secondary EFI file - i.e. GRUB2 or uefi shell placed in the root. /boot.efi Hardcoded bootloader boots "bootarm.efi"(1: windows bootmanager) Bootmanager loads BCD (2) Bootmanager loads SecureBootDebug.efi, and the SecureBootDebugPolicy.p7b Then loads a test.efi (lolhax? shim) \[this can be changed to our own shim, eg [https://github.com/imbushuo/boot-shim/releasesarrow-up-right](https://github.com/imbushuo/boot-shim/releases)\ \] Which finally loads our boot.efi Copy +efi +---microsoft +------boot +---------fonts (obvious) +---------bcd(2) +---------(automatically generated files) +---boot +------bootarm.efi(1) +unicode.pf2 +test.efi(3) +grub.cfg +BOOT.efi More detail here - [https://forum.xda-developers.com/windows-8-rt/rt-development/wip-secure-boot-linux-surface-rt-t3653848/page12arrow-up-right](https://forum.xda-developers.com/showpost.php?p=82452439&postcount=115) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/uefi-boot-sequence#further-reference) Further Reference ------------------------------------------------------------------------------------------------------------------------------------------ [https://wiki.debian.org/UEFIarrow-up-right](https://wiki.debian.org/UEFI) [https://www.rodsbooks.com/efi-bootloaders/controlling-sb.htmlarrow-up-right](https://www.rodsbooks.com/efi-bootloaders/controlling-sb.html) [https://www.suse.com/media/article/UEFI\_on\_Top\_of\_U-Boot.pdfarrow-up-right](https://www.suse.com/media/article/UEFI_on_Top_of_U-Boot.pdf) (although we use GRUB2, the boot process is quite similar, and this is worth a read!) [PreviousYahallo - Disable Securebootchevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot) [NextFAT32 isn't FAT32chevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # APX devicetree | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-apx#devicetree-for-surface-rt) Devicetree for Surface RT -------------------------------------------------------------------------------------------------------------------------------------------------------- The current devicetree for APX can be found here: [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)linux/arch/arm/boot/dts/tegra30-microsoft-surface-rt.dts at master · grate-driver/linuxGitHubchevron-right](https://github.com/grate-driver/linux/blob/master/arch/arm/boot/dts/tegra30-microsoft-surface-rt.dts) [PreviousDevicetreechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree) [NextUEFI devicetreechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-efi) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # FAT32 isn't FAT32 | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#the-issue) The issue ------------------------------------------------------------------------------------------------------------------------ For a long time it has been thought that only some USB drives work on these devices. Now the issue is known: FAT32 isn't FAT32. Windows's FAT32 is actually W95 FAT32 (LBA). But Linux creates proper FAT32. So a USB drive that is formatted with Linux won't work for these devices, because the UEFI firmware doesn't support proper FAT32. Here is a comparison from the two possible partitions (Program used is Gnome Disks): ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mi7v633KSmSguOPF9M8%252F-Mi7wE9SCrN6-NsrAQuW%252FFAT32-works.png%3Falt%3Dmedia%26token%3D76372fc1-de1b-49ac-9aac-8b9ed9ce90ed&width=768&dpr=3&quality=100&sign=ae7cf743&sv=2) Gnome Disks shows this for a working FAT32 partition. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mi7v633KSmSguOPF9M8%252F-Mi7wR6AqczmpJNKUheN%252FFAT32-doesnt-work.png%3Falt%3Dmedia%26token%3Dca7df833-e5c7-4be3-b715-cb57d66f8e8a&width=768&dpr=3&quality=100&sign=ab31efb1&sv=2) This is proper FAT32 which does not work. Type, (here german "Inhalt") doesn't matter. The parition type is meaningful. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#possible-solutions-usb-formatting) Possible solutions / USB formatting -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#format-the-usb-with-windows) Format the USB with Windows Here is are steps to achive this with diskpart: 1. In the Start menu, type `cmd`, and then click the entry for the cmd program. 2. At the command prompt, enter `diskpart` (you have to approve this operation as an administrator). The prompt line should now display "DISKPART". 3. Enter `list disk`. _lists your drives._ 4. Enter `select disk X`, _where X is the number of your selected disk._ **(MAKE SURE TO SELECT THE CORRECT ONE!!!).** 5. Enter `clean`. _wipes the selected drive partition table._ 6. Enter `create partition primary`. _creates a partition and marks it as primary._ 7. Enter `select partition 1`. _selects the partition number 1 (primary)._ 8. Enter `active`. _sets it as active (makes it bootable)._ 9. Enter `format fs=fat32 quick`. _formats the drive as FAT32 partition table (quick at the end indicates quick format)._ 10. Enter `assign`. _assigns the drive to a mount point._ 11. Enter `exit`. Source: [https://kb.iu.edu/d/bccmarrow-up-right](https://kb.iu.edu/d/bccm) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#change-partition-type-with-fdisk-using-linux) Change partition type with fdisk using Linux 1. Open a terminal and run this command to locate the right device: 2. Use `fdisk` command accordingly: 1. `sudo fdisk /dev/sdX`; `X` stands for the right disk letter something in the region of `b`, `c` or `d` 2. Type o to change the partition table type to `dos` 3. When the command runs type d and enter to delete the existing partition, then 4. Type n to create new partition 5. Accept the defaults when ask for the `partition type` and `size` (assuming that is desirable), 6. Type p to see what you have done, 7. Type t to change the file system type, 8. Type c to create a `W95 FAT32 (LBA)` partition, 9. Repeat step `2.5`, i.e. `5` above to see the created partition, 10. Type a to activate that partition so it automounts, 11. Type w to write the changes to disk 3. Format the again from the terminal: * **Note:** `i` represents the partition number in this case it should be `1` 4. Eject and replug the device [Source is Stack Overflowarrow-up-right](https://askubuntu.com/a/1064316) [PreviousUEFI Boot Sequencechevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/uefi-boot-sequence) [NextWindows RTchevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-rt) Last updated 4 years ago Was this helpful? * [The issue](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#the-issue) * [Possible solutions / USB formatting](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#possible-solutions-usb-formatting) * [Format the USB with Windows](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#format-the-usb-with-windows) * [Change partition type with fdisk using Linux](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32#change-partition-type-with-fdisk-using-linux) Was this helpful? sun-brightdesktopmoon Copy lsblk Copy sudo mkfs.vfat /dev/sdXi sun-brightdesktopmoon --- # Devicetree | Open Surface RT triangle-exclamation Please be careful with random device trees. They could contain wrong power management settings which could destroy your board. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree#apx-vs-uefi) APX vs UEFI ------------------------------------------------------------------------------------------------------------- Why do we need 2 different devicetrees for the same device? APX can use the full potential of the device. Therefore APX can boot with the full devicetree which enables all currently supported features. UEFI Firmware on the other hand blocks access to some power related features like PMIC regulators, L2 Cache and Dynamic Voltage Frequency Scaling. Therefore UEFI devicetree only removes features from the APX devicetree and only adds features which are currently UEFI exclusive. Furthermore the UEFI devicetree provides fixed regulators which in place of the PMIC regulators which are needed by other features. (e.g. µSD voltage switching from 3V3 to 1V8) [PreviousLinuxchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux) [NextAPX devicetreechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-apx) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Kernel source | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source#kernel-source) Kernel source -------------------------------------------------------------------------------------------------------------------- Since the beginning of July 2021 our changes to the Linux kernel are upstreamed to [grate-driver/linuxarrow-up-right](https://github.com/grate-driver/linux) . For pull requests we created our own fork: [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)GitHub - Open-Surface-RT/grate-linux: Linux kernel with experimental patches for Tegra. (Microsoft Surface RT, Microsoft Surface 2, Lenovo Ideapad Yoga 11)GitHubchevron-right](https://github.com/Open-Surface-RT/grate-linux) This fork contains the latest changes. Eventually they will be merged to grate at some point. This means you can either use `grate-driver/linux`, without the need of modifying the kernel source, or you can use `mainline` Linux, with the need of applying patches. [PreviousKernelchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel) [Nextgrate-driverchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/grate-driver) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UEFI devicetree | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-efi#devicetree-for-surface-rt) Devicetree for Surface RT -------------------------------------------------------------------------------------------------------------------------------------------------------- The current devicetree for EFI can be found here: [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)linux/arch/arm/boot/dts/tegra30-microsoft-surface-rt-efi.dts at master · grate-driver/linuxGitHubchevron-right](https://github.com/grate-driver/linux/blob/master/arch/arm/boot/dts/tegra30-microsoft-surface-rt-efi.dts) [PreviousAPX devicetreechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-apx) [NextKernelchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Appended devicetree | Open Surface RT ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build/old-stuff#append-devicetree) Append devicetree Append the devicetree to zImage to make a single Image which contains the kernel and the devicetree. This allows to use simpler bootloaders and minimizes errors that the bootloader can make. Copy cat ./arch/arm/boot/zImage ./arch/arm/boot/dts/tegra30-microsoft-surface-rt.dtb > ./arch/arm/boot/zImage Your kernel with appended devicetree should be located at `./arch/arm/boot/zImage` [PreviousConfigure & Buildchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build) [NextPrebuilt binarieschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Recovery Images | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#microsoft-surface-rt-1) **Microsoft Surface RT 1** --------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-recovery-environment) **Windows Recovery** Environment #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-rt-8.0) **Windows RT 8.0** * [Asiaarrow-up-right](https://mega.nz/file/wNMU1C7a#86dnL9OyBa8qTKchzb8OcohfOtici0Xap3DWWpDKz0I) * [CEE1arrow-up-right](https://mega.nz/file/wAMk0aTJ#J5XeVQnv2nHHB2gmEIh1VPaBeDW1JItjExCLbhERwAk) * [Chinaarrow-up-right](https://mega.nz/file/tFEGmQzL#PGpCcNwVcaTdfGyzJhAK6w9ZCx6RxtcFF4lkUKfpj_g) * [Europearrow-up-right](https://mega.nz/file/dIECTaCI#X8Kd4BVRUHoPxFFEOvgm1FJvlVuoL8tEPbmIKgZhIDM) * [Japanarrow-up-right](https://mega.nz/file/1JNGCIrR#WLgsnQX2N4nbCSeFvGk3C82ad3t-ARe0Bo3oPfbIF7U) * [Mediterraneanarrow-up-right](https://mega.nz/file/EEEkRaaB#jVtNBeiEZ_n6qM-0u9hDfVbrQERDqEyv96YWuqhs2Eg) * [Nordicarrow-up-right](https://mega.nz/file/5ZNEAKST#dY35ybF9BDnFDTC2avglQkNHe1-vuWg6H5vp8xCUlBo) * [North Americaarrow-up-right](https://mega.nz/file/ZZNAXSaT#It6jfgN5i_XGZOQreOg2K44msu8OYlNin6-co9fMlyA) * [SE Asiaarrow-up-right](https://mega.nz/file/xcdCCIwS#HMXoCdFlDv1V-DH4i24BweVUMSl-gh8qxiHHu2V54PA) * [Taiwanarrow-up-right](https://mega.nz/file/xZF0VSzB#8DmmBpNgasquQuQS4oQWXbIpwKAB8A__pUZhcZ3MxV4) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#wim-install-file) **WIM Install File** #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-10-build-15035) Windows **10 build 15035** * [Insider Previewarrow-up-right](https://mega.nz/file/sYU2Qa5R#00kt9jQyltrsOcOofSmUCyeU6cYH21QIVKfbTUgjcpE) * [Insider Previewarrow-up-right](https://mega.nz/file/sYU2Qa5R#00kt9jQyltrsOcOofSmUCyeU6cYH21QIVKfbTUgjcpE) (Mirror) #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-rt-8.0-1) Windows RT 8.0 * [Asiaarrow-up-right](https://mega.nz/file/4NN0VCZK#c29ABXALV2Rjxx99Omt2id4cXCU9HyFubGkM3CJFT4E) * [CEE1arrow-up-right](https://mega.nz/file/QYMWXQzT#CXT_tMP3N8ivh-VwobC-458WitgalBV8-sHi7NpHjhg) * [Chinaarrow-up-right](https://mega.nz/file/8AUQ2KSY#r9FjFBGbqsshYgPUe1sPncQyweAlipDJed9xiZHeUE4) * [Europearrow-up-right](https://mega.nz/file/NQUUyCiT#ewHrfcHVqlZBVBh3Caou0WPlsQrhkn_uGD975oL4GmA) * [Japanarrow-up-right](https://mega.nz/file/BUUAAKTJ#9bM2tlhHTIXug069DhlK5M-VjH2h8rYvBp-83QktObg) * [Mediterraneanarrow-up-right](https://mega.nz/file/NAU2Ua7A#ens-CNnQlI8tobEjmMZrsh9tkjD2mJbm3UqYDQt4KXk) * [Nordicarrow-up-right](https://mega.nz/file/NAUQGCBJ#0S575VbDJEjRULcJhOx6xHYhgO7AEMAvNREC00Qh99A) * [North Americaarrow-up-right](https://mega.nz/file/pEVEmAoJ#LHaZQD6PknL-yJLkTzpqS_CcnG4q8ncq101xJNoFBJ8) * [SE Asiaarrow-up-right](https://mega.nz/file/IRMy0A5S#hANUiYiUgG_M1uaQ-yRtgQirfzR-oSLMBw4AUVBUAnc) * [Taiwanarrow-up-right](https://mega.nz/file/RcEgHK5Y#TziAKMxtS6yJZicbl5ndVm6oUolIaXkGoZFqqoY99Z4) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#microsoft-surface-rt-2) **Microsoft Surface RT 2** --------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-recovery-environment-1) **Windows Recovery** Environment #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-rt-8.1) Windows RT 8.1 * [Oceaniaarrow-up-right](https://mega.nz/file/ZAUU2CaC#H_ddswiv3IJ1lcJg2X0rsuu8vQfwk7ijMBj_jZf9YqM) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#wim-install-file-1) WIM Install File #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#widows-rt-8.1) Widows RT 8.1 * [Oceaniaarrow-up-right](https://mega.nz/file/0Mt3BJiR#JQrB3qKNzCPxdOp6fMYoG_xO9Rs9OUDdwmZaZTxBU7U) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#lenovo-ideapad-yoga-11) **Lenovo IdeaPad Yoga 11** --------------------------------------------------------------------------------------------------------------------------------------------- _To be investigated, needs recovery images and test devices_ [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#asus-vivotab) **Asus VivoTab** ------------------------------------------------------------------------------------------------------------------------- _To be investigated, needs recovery images and test devices_ ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-recovery-environment-2) **Windows Recovery** Environment #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-rt-8.1-1) Windows RT 8.1 * [Genericarrow-up-right](https://mega.nz/file/5c10jYxD#hcUJZMYxOSTreD9HK759FQhMJU9NwFlzNSG2AeQ2Lts) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#wim-install-file-2) WIM Install File #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-rt-8.1-2) Windows RT 8.1 * [Genericarrow-up-right](https://mega.nz/file/sIkWWaIZ#JcINJcFrbtjrTupZQ_40-BBzkJDEzzBOi9Y9kFDTGr8) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#untested-recovery-images-for-other-devices) Untested Recovery Images for other devices --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [Herearrow-up-right](https://mega.nz/folder/V0tCFRCa#duGmPDuFuiVYor2r2YTX8Q) is a link to a website which holds recovery images for other devices that run Windows RT. If this link doesn't work anymore please contact us on the discord server. [PreviousRecovery Toolkitchevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit) [NextWindows 10chevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-10) Last updated 2 years ago Was this helpful? * [Microsoft Surface RT 1](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#microsoft-surface-rt-1) * [Windows Recovery Environment](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-recovery-environment) * [WIM Install File](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#wim-install-file) * [Microsoft Surface RT 2](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#microsoft-surface-rt-2) * [Windows Recovery Environment](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-recovery-environment-1) * [WIM Install File](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#wim-install-file-1) * [Lenovo IdeaPad Yoga 11](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#lenovo-ideapad-yoga-11) * [Asus VivoTab](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#asus-vivotab) * [Windows Recovery Environment](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#windows-recovery-environment-2) * [WIM Install File](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#wim-install-file-2) * [Untested Recovery Images for other devices](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images#untested-recovery-images-for-other-devices) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Yahallo - Disable Secureboot | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#what-is-yahallo) What is Yahallo -------------------------------------------------------------------------------------------------------------------------------------------------- Refer to The exploit in the dev section to get further information about it. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#how-does-it-work) How does it work ---------------------------------------------------------------------------------------------------------------------------------------------------- The Exploit starts in App.c. App.c transfers controll to DeviceLut.c It will compare the UEFI version to some entrys in a lookupTable In case of sRT it will apply a display fix first. DeviceLut.c transfers control to Exploit.c triangle-exclamation We suggest to only apply this if you need it. In most cases it is not necessary. At the moment you gain **no advantage**. [https://github.com/NekomimiRouter/yahalloarrow-up-right](https://github.com/NekomimiRouter/yahallo) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#executing-yahallo-exploit) Executing Yahallo exploit ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#quick-explanation-and-multiple-options) Quick explanation and multiple options You can easily disable secure boot by booting the [All-in-one Secureboot tool](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb#download) . Just download the ZIP, extract it to your USB and boot it. Select the options with an USB keyboard. For further information how to setup the USB go to the more detailed explanation bellow. More details can be found in the [Secure Boot page](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#the-new-method) and in the [All-in-one Secureboot tool page](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) . ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#full-explanation-and-single-option-usb) Full explanation and single option USB Prerequisites to start with the process! * Working USB drive formatted as **FAT32** * Surface RT/2 with **50% or more battery**, can be plugged in * Yahallo files to boot from * Windows Boot Manager exploit, this one is **important!!!** ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MWZPQXBFuOFuB8iZSK3%252F-MWZRFGB4UMcACcHj5gV%252F20210324_150908.jpg%3Falt%3Dmedia%26token%3D4e613c36-3ef8-4f4b-942f-25569025d514&width=768&dpr=3&quality=100&sign=c96edc84&sv=2) Surface RT and a USB drive (this one has 1GB capacity and LED activity indicator) file-archive 522KB [yahallo.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MWZPQXBFuOFuB8iZSK3%2F-MWZTF0ku5shjwfABC31%2Fyahallo.zip?alt=media&token=db8ab9dd-047d-4285-a9e7-bd979bda3ba8) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MWZPQXBFuOFuB8iZSK3%2F-MWZTF0ku5shjwfABC31%2Fyahallo.zip?alt=media&token=db8ab9dd-047d-4285-a9e7-bd979bda3ba8) Yahallo exploit Prepare the USB drive and format as FAT32, doesn't matter if it's MBR or GPT. In my case I name the drives after their capacity. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MWZPQXBFuOFuB8iZSK3%252F-MWZRh_jVQAIySR0DJhE%252Fflashdrive1.PNG%3Falt%3Dmedia%26token%3Daf4b1173-21f1-4f18-aa4c-4ad06ca15348&width=768&dpr=3&quality=100&sign=3554f390&sv=2) USB drive Extracting the files, make sure the folder contents are on your USB drive's root directory (example: E:\\ \[stuff is here\]) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MWZPQXBFuOFuB8iZSK3%252F-MWZS1olSRaDf7Ko-f9O%252Fflashdrive2.PNG%3Falt%3Dmedia%26token%3De6272e7f-1a09-4788-bacc-4e14ba625504&width=768&dpr=3&quality=100&sign=c5302452&sv=2) Once the files are copied over, unplug the drive from your PC and power off your Surface. Once powered off plug in the USB drive and boot from it by pressing power and holding volume down at the same time. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MWZPQXBFuOFuB8iZSK3%252F-MWZSdh1YNMhDu8Y9228%252F20210324_151152.jpg%3Falt%3Dmedia%26token%3Dd601567a-9557-4d62-913f-9b757e8dc2f3&width=768&dpr=3&quality=100&sign=fdaff964&sv=2) This should appear when holding volume down That's it! Exploit has been done and all you have to do is power off your tablet and turn back on. From my case at first it refused to display anything so I suggest leaving it for 5 minutes at most. Since SecureBoot is now disabled you can boot unsigned code like Linux, which is work in progress. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#undo) Undo To re-enable secureboot replace the "Yahallo.efi" file on your USB with the file bellow, make sure the naming is correct. file-download 31KB [YahalloUndo.efi](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MXY67egnlSmQzmukNOh%2F-MXY6mFd1j4i67Q6tpuq%2FYahalloUndo.efi?alt=media&token=e5d4a3c5-2e75-42b2-9c04-25bc1f4bb3d7) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MXY67egnlSmQzmukNOh%2F-MXY6mFd1j4i67Q6tpuq%2FYahalloUndo.efi?alt=media&token=e5d4a3c5-2e75-42b2-9c04-25bc1f4bb3d7) YahalloUndo Enabling secure boot brings you no advantage at all, you only restirct yourself with what you can do. [PreviousWindows Bootmanager Exploitchevron-left](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/windows-bootmanager-exploit) [NextUEFI Boot Sequencechevron-right](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/uefi-boot-sequence) Last updated 4 years ago Was this helpful? * [What is Yahallo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#what-is-yahallo) * [How does it work](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#how-does-it-work) * [Executing Yahallo exploit](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#executing-yahallo-exploit) * [Quick explanation and multiple options](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#quick-explanation-and-multiple-options) * [Full explanation and single option USB](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#full-explanation-and-single-option-usb) * [Undo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot#undo) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Booting | Open Surface RT UEFI boot gives you instructions on how to boot Linux using the UEFI firmware. [UEFI bootchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot) APX boot gives you instructions on how to boot Linux using the fusee gelee exploit. It's more complicated than UEFI boot as you need a second computer with the correct files. [APX bootchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot) Sometimes you need to edit the preconfigured kernel command line. Kernel parameters will give you a brief overview and tell you possible configuration options. [Kernel parameterschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters) [PreviousPrebuilt binarieschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) [NextKernel parameterschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # grate-driver | Open Surface RT ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/grate-driver#download-grate-driver-linux) Download grate-driver/linux Simply run`git clone https://github.com/grate-driver/linux.git --depth=1 && cd linux` to download the repository with a git history depth of 1 (to reduce the amount of data downloaded, full history is over 1 GB). [PreviousKernel sourcechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source) [NextMainlinechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Configure & Build | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#editing-kernel-build-configuration) Editing kernel build configuration --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- First run the command `make ARCH=arm tegra_defconfig` This will create a standard kernel config for tegra SoC's. Open the file `.config` in the kernel source directory with your favorite text editor and paste the following at the end of the file `CONFIG_EFI_STUB=y CONFIG_EFI=y CONFIG_I2C_HID_OF=y CONFIG_I2C_HOTPLUG_GPIO=y CONFIG_BATTERY_CHARGER_SURFACE_RT=y CONFIG_MWIFIEX=m CONFIG_MWIFIEX_SDIO=m CONFIG_SND_SOC_TEGRA_WM8962=y CONFIG_HID_MICROSOFT=y` Note that some drivers (Wi-Fi) are built as modules. See [exporting modules](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#exporting-modules) below to use them. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#build-the-kernel) Build the kernel --------------------------------------------------------------------------------------------------------------------------------------- To build the kernel use the command `make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- -j $(nproc)` - `$(nproc)` sets the number of threads to your CPU core count This command can take a while depending on your computer's speed. (5+ minutes) circle-info Note: If you get asked what configuration you want to choose, just press enter, this will take the standard value. If compiling was successful you should see some output similar to this: (This doesn't need to be a the end of the log. Scroll up a bit ;) ) `CALL scripts/checksyscalls.sh CALL scripts/atomic/check-atomics.sh CHK include/generated/compile.h Kernel: arch/arm/boot/Image is ready Kernel: arch/arm/boot/zImage is ready` The output kernel image is located at `arch/arm/boot/zImage` The output device tree is located at EFI:`arch/arm/boot/dts/tegra30-microsoft-surface-rt-efi.dtb`. APX:`arch/arm/boot/dts/tegra30-microsoft-surface-rt.dtb`. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#build-the-kernel-using-shell-script) Build the kernel using shell script ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- You can create a .sh script in kernel root to speed up your workflow plsMake.sh Copy #!/bin/bash make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- -j $(nproc) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#using-modules) Using modules --------------------------------------------------------------------------------------------------------------------------------- Some drivers will be built as modules. This reduces the kernel image size. The module folder needs to be placed on the rootfilesystem in `/lib/modules`. Some drivers need to be built as module. For example the Wi-Fi driver. Wi-Fi needs a firmware which will be send to the Wi-Fi SoC at the time the hardware is probed. This can happen before the root filesystem is mounted. Therefore the driver can't load the firmware. If wifi is built as module it won't be loaded before the root filesystem was mounted. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#exporting-modules) Exporting modules This command will place the modules folder next to your Linux kernel folder. circle-info You need to copy the modules after: - Modifying the kernel source for the first time - Every git commit - Editing a driver which is built as module (obvious?) [PreviousMainlinechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline) [NextAppended devicetreechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build/old-stuff) Last updated 4 years ago Was this helpful? * [Editing kernel build configuration](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#editing-kernel-build-configuration) * [Build the kernel](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#build-the-kernel) * [Build the kernel using shell script](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#build-the-kernel-using-shell-script) * [Using modules](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#using-modules) * [Exporting modules](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build#exporting-modules) Was this helpful? sun-brightdesktopmoon Copy make INSTALL_MOD_PATH=../ modules_install > /dev/null sun-brightdesktopmoon --- # Kernel | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#apx-and-uefi) APX and UEFI ----------------------------------------------------------------------------------------------------------- APX can boot normal and UEFI kernels. UEFI can only boot UEFI kernels. Therefore we use UEFI kernel for both methods of booting. This simplyfies development, testing and distributing kernel Images for both boot methods. circle-info Visit the main [Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux) page for a short comparison between EFI vs. APX Linux [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#prebuilt-binaries-vs.-self-compiling) Prebuilt binaries vs. self compiling ----------------------------------------------------------------------------------------------------------------------------------------------------------- Building a Kernel is an advanced process for most beginners. If you just want to use Linux on your Surface RT you should go with the [prebuilt binaries](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) . If you want to help developing you need to compile the kernel on your own. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#prebuilt-binaries) Prebuilt binaries If you don't want to compile a kernel yourself, just use the prebuilt binaries. They are built everytime new hardware support is added. These images additionally include a lot of USB drivers and are digitally signed. [Prebuilt binarieschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#compile-it-yourself) Compile it yourself Get information on how to compile a working Linux kernel. You can either use `mainline linux`, or `grate-driver/linux` (based on Linux-next with experimental changes for tegra devices). [Configure & Buildchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build) There are branches for all devices. Use the master tree to only get tested and stable features for all devices: [https://github.com/Open-Surface-RT/grate-linux/arrow-up-right](https://github.com/Open-Surface-RT/grate-linux/) Use the device speccific branches for your device: [https://github.com/Open-Surface-RT/grate-linux/tree/surface-rtarrow-up-right](https://github.com/Open-Surface-RT/grate-linux/tree/surface-rt) [https://github.com/Open-Surface-RT/grate-linux/tree/surface-2arrow-up-right](https://github.com/Open-Surface-RT/grate-linux/tree/surface-2) [https://github.com/Open-Surface-RT/grate-linux/tree/lenovo-ideapad-yoga-11arrow-up-right](https://github.com/Open-Surface-RT/grate-linux/tree/lenovo-ideapad-yoga-11) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#booting-the-kernel) Booting the kernel ----------------------------------------------------------------------------------------------------------------------- For information on how to boot your kernel, visit the Booting page. [Bootingchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting) [PreviousUEFI devicetreechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-efi) [NextKernel sourcechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source) Last updated 4 years ago Was this helpful? * [APX and UEFI](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#apx-and-uefi) * [Prebuilt binaries vs. self compiling](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#prebuilt-binaries-vs.-self-compiling) * [Prebuilt binaries](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#prebuilt-binaries) * [Compile it yourself](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#compile-it-yourself) * [Booting the kernel](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel#booting-the-kernel) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Kernel parameters | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#dtb) dtb= ------------------------------------------------------------------------------------------------------------- * `microsoft-surface-rt.dtb` for APX booting * `microsoft-surface-rt-efi.dtb` for EFI booting [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#root) root= --------------------------------------------------------------------------------------------------------------- Specifies the root filesystem which should be used. * `/dev/mmcblk0pN` eMMC partition `N` * `/dev/mmcblk1pN` µSD Card partition `N` * `/dev/sdaN` USB partition `N` [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#console) console= --------------------------------------------------------------------------------------------------------------------- * `tty0` for normal console (internal screen+tCover/USB keyboard) * `ttyS0,115200n8` for serial console at 115200 Baud, no parity bit, 8bits (need uart access) You can specify multiple console= options on the kernel command line. Output will appear on all of them. The last device will be used when you open `/dev/console`. So, for example: Copy console=ttyS1,9600 console=tty0 defines that opening `/dev/console` will get you the current foreground virtual console, and kernel messages will appear on both the VGA console and the 2nd serial port (ttyS1 or COM2) at 9600 baud. Note that you can only define one console per device type (serial, video). - [https://www.kernel.org/doc/html/latest/admin-guide/serial-console.htmlarrow-up-right](https://www.kernel.org/doc/html/latest/admin-guide/serial-console.html) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#rootwait) rootwait ---------------------------------------------------------------------------------------------------------------------- Waits for root filesystem. Some root filesystems will be mounted after the kernel finished initalizing hardware. Thats the case for USB. eMMC/SD seems to work without this parameter. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#cpuidle.off-1) cpuidle.off=1 -------------------------------------------------------------------------------------------------------------------------------- EFI doesn't support CPU idle therefore it must be disabled for efi booting. You shouldn't use this param for APX booting. [PreviousBootingchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting) [NextUEFI bootchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot) Last updated 4 years ago Was this helpful? * [dtb=](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#dtb) * [root=](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#root) * [console=](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#console) * [rootwait](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#rootwait) * [cpuidle.off=1](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters#cpuidle.off-1) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Simple RootFS | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/simple-rootfs#build-root-filesystem) Build root filesystem ---------------------------------------------------------------------------------------------------------------------------------------------------- Download Buildroot from [https://buildroot.org/download.htmlarrow-up-right](https://buildroot.org/download.html) unpack it open directory in terminal type: `make menuconfig` -> Target options -> configure for ARM. (see picture) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MK7BnKNxK-OIAelT2xX%252F-MK7CYztxdIPopLPbpam%252Fbuildroot-config.png%3Falt%3Dmedia%26token%3Df267f559-59f8-43ee-a726-46a424b124f8&width=768&dpr=3&quality=100&sign=28adf4f8&sv=2) There are maybe better choices but it works at the moment. Type: `make` wait for 15-20 minutes. A lot of stuff is downloaded and compiled. When finished you will find `./output/images/rootfs.tar` circle-info target packages: libraries -> hardware handling -> libgpiod\[\*\] -> install tools\[\*\] [PreviousRaspberry Pi OSchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) [NextTrouble Shootingchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/trouble-shooting) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Root Filesystem | Open Surface RT After building a kernel you need a userspace which contains all the binaries you want in your system. Like echo, cat, ls, candy crush (o.O looking at you MS) There are two ways to get these binaries [Option 1](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem#option-1-build-your-own-root-filesystem) : Build your own root filesystem with Buildroot or similar tools [Option 2](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem#option-2-get-an-arm-distro) : Get a premade root filesystem (distro) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem#option-1-build-your-own-root-filesystem) Option 1: Build your own Root Filesystem --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- pro contra Very small (few MB) You need to install all packages by yourself Boots very fast For advanced users [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem#option-2-get-an-arm-distro) Option 2: Get an ARM Distro ------------------------------------------------------------------------------------------------------------------------------------------------- pro contra Many packages preinstalled Large (up to few GB) Community support Bloated Easy for beginners (except Arch) [PreviousPrepare SD Cardchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/prepare-sd-card) [NextDistributionschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros) Last updated 4 years ago Was this helpful? * [Option 1: Build your own Root Filesystem](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem#option-1-build-your-own-root-filesystem) * [Option 2: Get an ARM Distro](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem#option-2-get-an-arm-distro) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Trouble Shooting | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/trouble-shooting#doesnt-boot) Doesn't boot -------------------------------------------------------------------------------------------------------------------- Make sure that you have Yahallo applied. See [here](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/trouble-shooting#wifi-doesnt-work) Wifi doesn't work ------------------------------------------------------------------------------------------------------------------------------ Make you that you copied the modules forlder to /lib/modules Make sure that the kernel version and the modules version do match Get the modules folder name and compare it to `uname -r` [PreviousSimple RootFSchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/simple-rootfs) [NextHardwarechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware) Last updated 4 years ago Was this helpful? * [Doesn't boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/trouble-shooting#doesnt-boot) * [Wifi doesn't work](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/trouble-shooting#wifi-doesnt-work) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # postmarketOS | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos#instructions) Instructions ----------------------------------------------------------------------------------------------------------------------------------------- [https://wiki.postmarketos.org/wiki/Microsoft\_Surface\_RT\_(microsoft-surface-rt)arrow-up-right](https://wiki.postmarketos.org/wiki/Microsoft_Surface_RT_(microsoft-surface-rt)) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos#prebuilt-images) Prebuilt images ----------------------------------------------------------------------------------------------------------------------------------------------- Currently there are no prebuilt images available. Please build your own image using pmbootstrap. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfwWY_6SIk68N_64ULl%252F-MfwXsD1Yf5bn4kjlje2%252FpostmarketOS.jpg%3Falt%3Dmedia%26token%3Dc1708771-df14-4bdc-a559-7871f3e7e657&width=768&dpr=3&quality=100&sign=eedec5ae&sv=2) postmarketOS booting on Surface RT [PreviousDistributionschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros) [NextRaspberry Pi OSchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) Last updated 2 years ago Was this helpful? * [Instructions](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos#instructions) * [Prebuilt images](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos#prebuilt-images) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Recovery Toolkit | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#recovery-environment) Recovery Environment -------------------------------------------------------------------------------------------------------------------------------------- To let the toolkit make adjustments to the storage of the RT device we have to boot onto a Windows 8.0 recovery environment. If you plan to do these you should first turn off any bit-locker encryption on the RT device. Prepared recovery images that include the scripts and files are provided below. The base image is 500MiB but has to be supplied with an install file to apply. These are separated to the recovery image. Different regions are there to give the correct language, keyboard and culture options. Different regions should work on the hardware. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#booting-recovery) Booting Recovery Booting into the recovery mode is done by following these steps * Switch off your device * Press and hold the _volume down_ button * Press the _power_ button * Release the _volume down_ button after the surface logo appears * Wait about 2-3 minutes for the recovery environment to load (depending on usb stick speed) Once loaded up in recovery you are asked to select a language and keyboard layout, do so. Proceed to then select the Troubleshoot and Advanced Options to get a CMD window. Execute the following command in the terminal window. Copy X:\Windows\System32>D: D:\>menu.cmd You will be greeted with a verification question that bit-locker is turned off. Once confirmed you are presented with the main menu. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#using-the-toolkit) Using the Toolkit -------------------------------------------------------------------------------------------------------------------------------- You can navigate the menu's by entering the number of the corresponding menu item. 0 will always bring you up in the menu tree. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#automated-installs) Automated Installs In automated installs you can wipe, automatically partition and install a .wim file that was put in the sources folder of the recovery. For Windows 8.0 this file is named Install.wim, these should also come with a CreatePartitions-UEFI.txt file to partition the disk with. Windows 10 only requires a file named Install\_10\_15035.wim and uses the /sources diskpart script. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#partitioning) Partitioning Partitioning automates the wiping and partitioning of your device. It can format using the CreatePartitions-UEFI.txt in the sources folder or use the 2 default scripts provided in the Scripts folder. 4K is there because it was provided in the original source. Normally no 4K disks are used in known devices. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#installs) Installs Installs executes dism with an .wim image out of the sources folder on the recovery disk. Respectively called Install.wim and Install\_10\_15035.wim. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#boot) Boot Under boot you can copy over the boot EFI files to be able to boot Windows RT, add installed windows version to the boot manager and copy a broken copy of grub over to the efi partition and put it as boot manager instead. Using the copy efi options will copy a version of the windows boot manager to the S partition. This is necessary to boot any windows version. Windows 8.0 is happy with the recovery efi. Windows 10 requires a espefi for reasons. The grub is version 2.02 and is the only non windows environment the surface has booted in. The grub install comes with a config that has quite a flew automatic boot discovery options and basic actions. The grub config is unable currently to boot windows itself, so it makes it useless in that sense. Only do this if you intend to use or modify the configuration. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#unlock) Unlock Under unlock you can apply bcdedit commands for testsigning and the secureboot soft disable to allow our self signed binaries. [PreviousJailbreak Exploitschevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/jailbreak-exploits) [NextRecovery Imageschevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-images) Last updated 2 years ago Was this helpful? * [Recovery Environment](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#recovery-environment) * [Booting Recovery](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#booting-recovery) * [Using the Toolkit](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#using-the-toolkit) * [Automated Installs](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#automated-installs) * [Partitioning](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#partitioning) * [Installs](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#installs) * [Boot](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#boot) * [Unlock](https://open-rt.gitbook.io/open-surfacert/common/windows-rt/recovery-toolkit#unlock) Was this helpful? sun-brightdesktopmoon Copy [MAIN MENU] ========================== 1 | AUTOMATED INSTALLS 2 | PARTITIONING 3 | INSTALL 4 | BOOT 5 | UNLOCK Copy [AUTOMATED INSTALLS] WARNING, THESE WIPE THE ENTIRE DISK 0 | UP ========================== 1 | WINDOWS 8.0 2 | WINDOWS 10 Copy [PARTITIONING] WARNING, THESE WIPE THE ENTIRE DISK 0 | UP ========================== 1 | CREATEPARTITIONS-UEFI (IF INSTALL PRESENT) 2 | 512K 3 | 4K Copy [INSTALLS] WARNING, THESE WIPE THE INSTALLED OS 0 | UP ========================== 1 | INSTALL WINDOWS RT 8.0 2 | INSTALL WINDOWS RT 10 Copy [BOOT] 0 | UP ========================== 1 | COPY RECOVERY EFI 2 | COPY ESP EFI 3 | SCAN AND ADD BOOT DEVICES 4 | COPY GRUB AS BOOT (EXPERIMENTAL) Copy [UNLOCK] 0 | UP ========================== 1 | SET TESTSIGNING MODE 2 | APPLY SECUREBOOT SIGNING WORKAROUND sun-brightdesktopmoon --- # Tegra3 - Technical Reference Manual | Open Surface RT Nvidia provides a TRM (Technical Reference Manual). You can download the latetest TRM from Nvidias page [herearrow-up-right](https://developer.nvidia.com/embedded/tegra-3-reference) but you need to register an developer account. [https://developer.nvidia.com/embedded/tegra-3-referencearrow-up-right](https://developer.nvidia.com/embedded/tegra-3-reference) Page 20ff. Lists some Alternate pin functions. [https://www.data-modul.com/sites/default/files/products/Colibri%20T30%20Tegra3%201GB\_specification\_12004760.pdfarrow-up-right](https://www.data-modul.com/sites/default/files/products/Colibri%20T30%20Tegra3%201GB_specification_12004760.pdf) [https://pinout.torizon.io/arrow-up-right](https://pinout.torizon.io/) Even better information about GPIO Special functions file-pdf 23MB [Tegra3\_publicTRM\_DP05644001\_v03.pdf](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRN_hP9C7RQD2TlWAA%2F-MJROpG1m9hyTMlArrta%2FTegra3_publicTRM_DP05644001_v03.pdf?alt=media&token=01a82167-f219-419f-b888-b793d10f75db) PDF downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRN_hP9C7RQD2TlWAA%2F-MJROpG1m9hyTMlArrta%2FTegra3_publicTRM_DP05644001_v03.pdf?alt=media&token=01a82167-f219-419f-b888-b793d10f75db) Tegra3 - Technical Reference Manual file-pdf 3MB [Colibri T30 Tegra3 1GB\_specification\_12004760(1).pdf](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeJOLIqh-yXFh4YW8Kz%2F-MeJOOUrvVFuxZO98DOR%2FColibri%20T30%20Tegra3%201GB_specification_12004760(1).pdf?alt=media&token=283baaa7-ff97-4dd2-92a1-6de8fa16bdda) PDF downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeJOLIqh-yXFh4YW8Kz%2F-MeJOOUrvVFuxZO98DOR%2FColibri%20T30%20Tegra3%201GB_specification_12004760(1).pdf?alt=media&token=283baaa7-ff97-4dd2-92a1-6de8fa16bdda) [https://www.kontron.com/download/download?filename=/downloads/manuals/smarc-sat30-user-guide-v1.0-.pdf&product=89882www.kontron.comchevron-right](https://www.kontron.com/download/download?filename=/downloads/manuals/smarc-sat30-user-guide-v1.0-.pdf&product=89882) [PreviousHardwarechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware) [NextJ14 OEM Debug Connectorchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector) Last updated 3 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Fusée Gelée | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee#get-fusee-gelee-launcher) Get Fusée Gelée launcher --------------------------------------------------------------------------------------------------------------------------------------------------------- Copy git clone https://github.com/tofurky/tegra30_debrick cd tegra30_debrick git submodule init && git submodule update For further steps see [BCT Table](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/bct-table) and [NvFlash](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/untitled) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee#pre-made-package) Pre-made package ----------------------------------------------------------------------------------------------------------------------------------------- See [binaries](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/binarys#fusee-gelee) [PreviousDas U-Bootchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot) [NextBCT Tablechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/bct-table) Last updated 4 years ago Was this helpful? * [Get Fusée Gelée launcher](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee#get-fusee-gelee-launcher) * [Pre-made package](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee#pre-made-package) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Prebuilt binaries | Open Surface RT All zImage files that have `(signed)` at the end, are digitally signed by @Leander. Here is the certificate file: file-download 1KB [Leander.crt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeAwhYRP3kt9O40hm2P%2F-MeAzeUlFUSwqBCXXMzz%2FLeander.crt?alt=media&token=8de41d74-3d6b-4a91-acd8-a3659d7ea2d5) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeAwhYRP3kt9O40hm2P%2F-MeAzeUlFUSwqBCXXMzz%2FLeander.crt?alt=media&token=8de41d74-3d6b-4a91-acd8-a3659d7ea2d5) Certificate file All files built include a lot of USB device drivers, so features like USB RNDIS will work. For booting take the zip bellow, extract to USB and place your desired zImage and devicetree file onto the USB (don't rename). For more information visit the [Booting](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot) . file-archive 288KB [usb-linux-boot.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-Miv2LXQMtgfQZB7tUEL%2F-Miv387j-uOAVCFsjVDJ%2Fusb-linux-boot.zip?alt=media&token=d2503480-851d-4203-b3cb-30e40d0b9ba2) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-Miv2LXQMtgfQZB7tUEL%2F-Miv387j-uOAVCFsjVDJ%2Fusb-linux-boot.zip?alt=media&token=d2503480-851d-4203-b3cb-30e40d0b9ba2) You may want to change the line that begins with `zImage`! Kernel files are distributed in a long name for archival sake so double check if you renamed it to just `zImage`. `root=/dev/mmcblk1p2` is the second partition of the SD card, change this if you want to use a different device/partition. [RPI OS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) is a recommended distro, as it runs smooth `root=/dev/mmcblk0p2` is a location set to internal storage (eMMC) second partition, set it to this after cloning the installation over to internal storage. `root=/dev/sda2` is a second partition for USB only boot, set it to this if you want to USB boot only ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#definitions) Definitions `mmc` stands for the storage type, more specifically a MMC memory module like eMMC storage or a SD card. `mmcblk[]0[]` would be used to specify the exact partition in a boot configuration file, for example root filesystem partition, in this case it can be `mmcblk[]p2` for typical Linux distros. `0p[]` is used for internal storage definition as it's the primary MMC module `1p[]` is used for external MMC storage like a SD card Typical Linux distro consists of two partitions; small FAT32 formatted boot partition with kernel stuff and a main root partition which contains the entire filesystem. Root file system is formatted as EXT4 in most cases! In this case `mmcblk[]p1` is a **FAT32 boot partition** and `mmcblk[]p2` is a **root file system.** `sda[]` is used to define a USB drive's partition as it's considered an external media. In our case `sda1` would be **FAT32 boot partition** and `sda2` a **root file system.** circle-exclamation **Modules** are **required for** features like **WiFi**. Make sure to extract them to the root of your root filesystem. The **lib folders** of the ZIP and of the root filesystem **should merge**. The modules are not required for booting, you can extract them while the system is running on your Surface RT. (E.g. When you are not able to extract the modules to a EXT4 filesystem on your main PC) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#grate-driver-linux-kernel) grate-driver/linux kernel ------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#latest-binaries) Latest binaries The latest binaries and modules of kernel, devicetree, modules can be found below. file-archive 14MB [surface-rt-6.4-kernel-inc-modules.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJQb34R_xPz0ll0scbM%2Fuploads%2Ffc8lC01Lob9eAAw7wuDn%2Fsurface-rt-6.4-kernel-inc-modules.zip?alt=media&token=97b9d270-5b51-472e-b606-2902d14dbb6b) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJQb34R_xPz0ll0scbM%2Fuploads%2Ffc8lC01Lob9eAAw7wuDn%2Fsurface-rt-6.4-kernel-inc-modules.zip?alt=media&token=97b9d270-5b51-472e-b606-2902d14dbb6b) file-archive 10MB [surface-rt-5.17.0-rc7-kernel-inc-modules.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJQb34R_xPz0ll0scbM%2Fuploads%2FbwMIYpHSLRbjXxKf5Lom%2Fsurface-rt-5.17.0-rc7-kernel-inc-modules.zip?alt=media&token=b0e1f827-2336-442f-8494-47bf4404d0f5) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJQb34R_xPz0ll0scbM%2Fuploads%2FbwMIYpHSLRbjXxKf5Lom%2Fsurface-rt-5.17.0-rc7-kernel-inc-modules.zip?alt=media&token=b0e1f827-2336-442f-8494-47bf4404d0f5) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#rpi-os-bookworm-usb-prebuilt-disk-image) RPI-OS Bookworm USB prebuilt disk image ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Write to USB disk with e.g. rufus/etcher and boot. [https://files.open-rt.party/Linux/Distro/2023-10-10-raspios-bookworm-surface-rt-armhf-full.img.xzfiles.open-rt.partychevron-right](https://files.open-rt.party/Linux/Distro/2023-10-10-raspios-bookworm-surface-rt-armhf-full.img.xz) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#previous-kernels-and-other-devices) Previous kernels and other devices ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Ffiles.open-rt.party%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=feebdb08&sv=2)Index of /Linux-Kernel-Download/files.open-rt.partychevron-right](https://files.open-rt.party/Linux-Kernel-Download/) triangle-exclamation No support for older builds. Use at your own risk. [PreviousAppended devicetreechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build/old-stuff) [NextBootingchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting) Last updated 2 years ago Was this helpful? * [Definitions](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#definitions) * [grate-driver/linux kernel](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#grate-driver-linux-kernel) * [Latest binaries](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#latest-binaries) * [RPI-OS Bookworm USB prebuilt disk image](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#rpi-os-bookworm-usb-prebuilt-disk-image) * [Previous kernels and other devices](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#previous-kernels-and-other-devices) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Mainline | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#download-mainline-linux) Download mainline Linux ------------------------------------------------------------------------------------------------------------------------------------------------- You should be able to use the latest versions without problems. You can get it on Github: `git clone https://github.com/torvalds/linux.git --depth=1` or use .tar files from kernel.org [https://www.kernel.org/arrow-up-right](https://www.kernel.org/) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#applying-patches) Applying patches ----------------------------------------------------------------------------------------------------------------------------------- circle-info grate-driver/linux has these patches already included. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#adding-a-devicetree) Adding a devicetree Go to `./arch/arm/boot/dts`, create a file with the name `tegra30-microsoft-surface-rt-efi.dts` and paste the contents of the code block in the [devicetree sub-section](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-efi) . Search for `dtb-$(CONFIG_ARCH_TEGRA_3x_SOC) +=` in the Makefile (same directory), there you can see a few lines which begin with `tegra30`, add a line with the devicetree file name you created above, but instead of the extension .dts use .dtb. Be aware that you will need to add a backslash (\\) at the end of the previous line. Here is a picture how it should look like: ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MSchLVeclD3RLHlHpi_%252F-MScpR0elxcSjIGxpbtR%252Fgrafik.png%3Falt%3Dmedia%26token%3D13ad349b-2b3b-4385-a8c6-bc9559e16bd9&width=768&dpr=3&quality=100&sign=230d652d&sv=2) Picture shows the wrong file name ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#apply-patch-for-acpi-parking-protocol) Apply patch for ACPI Parking Protocol Open up a terminal and cd into your linux-5.12.3 directory. Then download the patch from bellow and run `git apply 0001-Add-ACPI-Parking-Protocol-for-arm32-devices.patch` This should add ACPI Parking Protocol to your kernel and allows you to use SMP. The patch doesn't follow kernel coding conventions. This will eventually be fixed. file-download 7KB [0001-Add-ACPI-Parking-Protocol-for-arm32-devices.patch](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MU9gP7m0qg7kUm6HT_9%2F-MU9k0ULYJcSAE43amav%2F0001-Add-ACPI-Parking-Protocol-for-arm32-devices.patch?alt=media&token=78c1370c-1d51-4dc6-87d9-370a3afd3f65) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MU9gP7m0qg7kUm6HT_9%2F-MU9k0ULYJcSAE43amav%2F0001-Add-ACPI-Parking-Protocol-for-arm32-devices.patch?alt=media&token=78c1370c-1d51-4dc6-87d9-370a3afd3f65) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#apply-patch-for-tcover) Apply patch for tCover This patch was created from commit c0a5652f from grate-driver/linux. The changes in the devicetree were removed. (Created with `git format-patch -1 c0a5652f`) Run`git apply 0001-WIP-ARM-tegra-Add-Type-Touch-Power-Cover-support-for.patch` to apply the patch. file-download 2KB [0001-WIP-ARM-tegra-Add-Type-Touch-Power-Cover-support-for.patch](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeARFO7qXYek6PP7XFE%2F-MeASyyhUZrrt-ttqly8%2F0001-WIP-ARM-tegra-Add-Type-Touch-Power-Cover-support-for.patch?alt=media&token=628adeec-38b0-4c00-8d12-f202c65fe0fb) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeARFO7qXYek6PP7XFE%2F-MeASyyhUZrrt-ttqly8%2F0001-WIP-ARM-tegra-Add-Type-Touch-Power-Cover-support-for.patch?alt=media&token=628adeec-38b0-4c00-8d12-f202c65fe0fb) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#apply-patch-for-i2c-gpio-hotplug-for-tcover) Apply patch for I2C GPIO hotplug for tCover This patch was created from commit e2a2772b from grate-driver/linux. (Create with `git format-patch -1 e2a2772b`) Run `git apply 0001-i2c-GPIO-based-hotplug-gate.patch` to apply the patch. file-download 9KB [0001-i2c-GPIO-based-hotplug-gate.patch](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeAVWoRz62fTXitX9lU%2F-MeAqFMcHlLNmrNJ7YYA%2F0001-i2c-GPIO-based-hotplug-gate.patch?alt=media&token=3430f573-dfaa-461b-8c93-8d8de9a155e5) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeAVWoRz62fTXitX9lU%2F-MeAqFMcHlLNmrNJ7YYA%2F0001-i2c-GPIO-based-hotplug-gate.patch?alt=media&token=3430f573-dfaa-461b-8c93-8d8de9a155e5) [Previousgrate-driverchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/grate-driver) [NextConfigure & Buildchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build) Last updated 4 years ago Was this helpful? * [Download mainline Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#download-mainline-linux) * [Applying patches](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#applying-patches) * [Adding a devicetree](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#adding-a-devicetree) * [Apply patch for ACPI Parking Protocol](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#apply-patch-for-acpi-parking-protocol) * [Apply patch for tCover](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#apply-patch-for-tcover) * [Apply patch for I2C GPIO hotplug for tCover](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/source/mainline#apply-patch-for-i2c-gpio-hotplug-for-tcover) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Hardware | Open Surface RT The Surface RT was launched in October 2012 It contains a TEGRA 3 (aka Tegra30 processor), and 2G of ram. [https://support.microsoft.com/en-us/help/4037671/surface-surface-rt-specificationsarrow-up-right](https://support.microsoft.com/en-us/help/4037671/surface-surface-rt-specifications) **See the** [**IC page**](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components) **for further information** Release Date October 2012 Display Screen: 10.6" 1366x768 16:9 Display - LTL106AL01-002 (1368x768) LVDS Backlight WLED 12V; Screen Input Voltage: 3.3V SoC Nvidia Tegra 3 T30 CPU Quad core Cortex-A9 @ 1.3 GHz Core architecture ARMv7/ARMhf 32-bit RAM Micron 2RE22 D9QBJ 2 GB DDR3 SDRAM Storage \- Samsung KLMBG4GE4A NAND Flash \- 64GB or 32GB capacity Camera 1.2MP Rear and 1.2MP Front Operating System Windows RT 8.0 (Upgradable to Windows RT 8.1) Battery Samsung Li-ion: 7.4V at a 31.5 Wh [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware#hardware-pictures) Hardware pictures ----------------------------------------------------------------------------------------------------------------- Large image of PCB [https://d3nevzfk7ii3be.cloudfront.net/igi/kJPLhr5dsLNwXTAbarrow-up-right](https://d3nevzfk7ii3be.cloudfront.net/igi/kJPLhr5dsLNwXTAb) Teardown with photos of board and setup [https://www.techrepublic.com/pictures/cracking-open-the-microsoft-surface-with-windows-rt/arrow-up-right](https://www.techrepublic.com/pictures/cracking-open-the-microsoft-surface-with-windows-rt/) [PreviousTrouble Shootingchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/trouble-shooting) [NextTegra3 - Technical Reference Manualchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/tegra3-technical-reference-manual) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # APX boot | Open Surface RT circle-info APX booting is for advanced users. Visit the main [Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux) page for a short comparison between EFI vs. APX Linux circle-exclamation You should read all the the sub-sections before you start. The subsections are logical ordered from top to bottom Get the latest and tested Devicetree for APX boot. [APX devicetreechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree/devicetree-apx) As we bypass all the firmware with APX boot, someone needs to setup memory and load Linux. Uboot is used for this. [Das U-Bootchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot) Get prebuilt binaires for Das U-Boot if you don't want to compile it yourself. [Binarieschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/binarys) Get a Linux kernel for APX. [Configure & Buildchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build) [Prebuilt binarieschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) Linux without any root filesystem is useless for the end-user. Get instructions on how to get one. [Root Filesystemchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem) Fusée Gelée is the exploit used to bypass the security checks for APX mode. Get information on how to execute the exploit in order to boot linux. [Fusée Geléechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee) Booting linux with APX mode is rather complicated. You can find a little summary and final instructions here: [Boot Linuxchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux) [PreviousUEFI bootchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot) [NextDas U-Bootchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Distributions | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#arm32-distros) ARM32 Distros ------------------------------------------------------------------------------------------------------------------------------ There are still a few distros out there which support ARM32 * [Raspberry Pi OS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) * [postmarketOS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos) * [Ubuntu Serverarrow-up-right](https://wiki.ubuntu.com/ARM/SurfaceRT) * Archlinux * Fedora * Lubuntu 16.04 * ... (append it pls) Downloads for older and probably dated builds can be found here: [https://berryboot.alexgoldcheidt.com/images/arrow-up-right](https://berryboot.alexgoldcheidt.com/images/) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#recommend-distros) Recommend Distros -------------------------------------------------------------------------------------------------------------------------------------- To make use of hardware acceleration we need to use grate-driver Following distros support grate-driver out of box: * Archlinux * PostmarketOS [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#choosing-a-distro) Choosing a Distro -------------------------------------------------------------------------------------------------------------------------------------- Linux comes in all different flavors just like ice cream, you can choose whatever fits you. For ease anything Debian based is recommended, advanced users can look for Arch or Fedora. Difference is how commands work but deep down everything is nearly same. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#install-and-boot) Install and boot ------------------------------------------------------------------------------------------------------------------------------------ > There are two ways of booting Linux, APX payload or EFI boot, this time let's focus on EFI. 1. Prepare SD card with any [Distroarrow-up-right](https://openrt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros) of your choice You can use Balena etcher, Rufus, Raspberry imager etc. Doesn't matter which one 2. Prepare a FAT32 formatted USB drive with EFI and kernel files, they are linked below, extract to root directory 3. Put the SD card in your Surface 4. Turn off tablet, complete shutdown and not sleep mode 5. Plug in the USB drive you prepared 6. Turn on by holding volume down key, release it when the logo appears 7. Let it boot. If it does it will go past the kernel log and load a distro of your choice. It should be safe to unplug the USB once Distro has loaded up. (The distro could have mounted the USB, so be careful with that) [PreviousRoot Filesystemchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem) [NextpostmarketOSchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos) Last updated 4 years ago Was this helpful? * [ARM32 Distros](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#arm32-distros) * [Recommend Distros](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#recommend-distros) * [Choosing a Distro](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#choosing-a-distro) * [Install and boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros#install-and-boot) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # J14 OEM Debug Connector | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector#how-to-access-j14) How to access J14 ----------------------------------------------------------------------------------------------------------------------------------------- Open your device according to this IFIXIT Guide: [https://de.ifixit.com/Teardown/Microsoft+Surface+Teardown/11275arrow-up-right](https://de.ifixit.com/Teardown/Microsoft+Surface+Teardown/11275) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MJRDGFsnXSDAflU2rec%252F-MJRDM1Lgs3bXoLED7FK%252Fsurface_windows_rt_teardown_027.png%3Falt%3Dmedia%26token%3D458982a5-cc03-4dba-9848-84c1aeb49fd1&width=768&dpr=3&quality=100&sign=bd210eb5&sv=2) https://www.techrepublic.com/pictures/cracking-open-the-microsoft-surface-with-windows-rt/26/ The pads are coated with a solder mask. The solder mask can be removed carefully with a sharp object. triangle-exclamation Be careful you don't want to cut any traces. This could damage and destroy your device! Pad size is **0.5mm** ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MJR81GQB3u6N95hSVcJ%252F-MJR9o2Ggzth2rkQBLCT%252FJ14.png%3Falt%3Dmedia%26token%3D9c9e0f27-b12b-474f-bb23-323fc19d23fc&width=768&dpr=3&quality=100&sign=14274c99&sv=2) J14 Connector on Mainboard of SurfacRT - taken from https://arstechnica.com/gadgets/2012/10/under-the-surface-ifixit-breaks-down-microsofts-tablet/ and upscaled [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector#j14-schematic) J14 Schematic --------------------------------------------------------------------------------------------------------------------------------- If you can identify some pins feel free to update this Schematic template file-download 11KB [SurfaceRT-J14.ots](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJREPXkqtGJMVWU7BMN%2F-MJRFOXooqWtC4V3mXJh%2FSurfaceRT-J14.ots?alt=media&token=026244c3-7a01-4e46-b902-9847b94dbdf8) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJREPXkqtGJMVWU7BMN%2F-MJRFOXooqWtC4V3mXJh%2FSurfaceRT-J14.ots?alt=media&token=026244c3-7a01-4e46-b902-9847b94dbdf8) SurfaceRT-J14-Schematic ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MR1Dm9Eig0kocRb5kdO%252F-MR1z54-3Qo6D1gdfG3b%252Fimage.png%3Falt%3Dmedia%26token%3D59dee952-ba52-4f86-92e3-5df504e35dff&width=768&dpr=3&quality=100&sign=6d7fd8fa&sv=2) [PreviousTegra3 - Technical Reference Manualchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/tegra3-technical-reference-manual) [NextUARTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart) Last updated 4 years ago Was this helpful? * [How to access J14](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector#how-to-access-j14) * [J14 Schematic](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector#j14-schematic) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Das U-Boot | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#how-to-build-u-boot) How to build u-boot ----------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#get-source-code) Get source code You can use U-boot for tegra `git clone https://github.com/OE4T/u-boot-tegra; cd u-boot-tegra` or U-boot Mainline `git clone https://gitlab.denx.de/u-boot/u-boot.git; cd u-boot` ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#add-change-devicetree) Add/change Devicetree triangle-exclamation _**THIS IS VERY IMPORTANT!!!**_ If you skip this step **you** can damage your device Use the devicetree **below**. **Don't** use the devicetree from Linux. Replace the content of `./arch/arm/dts/tegra30-cardhu.dts` with following code: Copy /dts-v1/; #include "tegra30.dtsi" / { model = "NVIDIA Cardhu"; compatible = "nvidia,cardhu", "nvidia,tegra30"; chosen { stdout-path = &uarta; }; aliases { mmc0 = "/sdhci@78000600"; mmc1 = "/sdhci@78000000"; }; memory { device_type = "memory"; reg = <0x80000000 0x40000000>; }; sdhci@78000000 { status = "okay"; cd-gpios = <&gpio TEGRA_GPIO(I, 5) GPIO_ACTIVE_LOW>; wp-gpios = <&gpio TEGRA_GPIO(T, 3) GPIO_ACTIVE_HIGH>; power-gpios = <&gpio TEGRA_GPIO(D, 7) GPIO_ACTIVE_HIGH>; bus-width = <4>; }; sdhci@78000600 { status = "okay"; bus-width = <8>; non-removable; }; clocks { compatible = "simple-bus"; #address-cells = <1>; #size-cells = <0>; clk32k_in: clock@0 { compatible = "fixed-clock"; reg=<0>; #clock-cells = <0>; clock-frequency = <32768>; }; }; }; &uarta { status = "okay"; }; ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#build-u-boot) Build U-Boot Now you can build U-Boot: `make cardhu_defconfig make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf-` Now you should find the file`./u-boot-dtb-tegra.bin` This your Uboot Image which contains the SPL and Uboot. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#boot-script) Boot script ------------------------------------------------------------------------------------------------------------------------- Booting Linux from UART is tedious and you may don't have UART access. To automate the boot process a boot script can be used. Create a file: Compile it using: `mkimage -A arm -O linux -a 0 -e 0 -T script -C none -n "SurfaceRT Boot Script" -d boot.script boot.scr` Place `boot.scr` on the SD Card next to the kernel. Tip: Don't hit any key to stop autoboot ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MLdUQuZwCzNHP2vs7fj%252F-MLdVr_xxn4mfZu3Tqtl%252Fimage.png%3Falt%3Dmedia%26token%3D00ade87c-80d8-4be8-8837-89e4d806bcc2&width=768&dpr=3&quality=100&sign=dbfa06ed&sv=2) [PreviousAPX bootchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot) [NextFusée Geléechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee) Last updated 4 years ago Was this helpful? * [How to build u-boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#how-to-build-u-boot) * [Get source code](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#get-source-code) * [Add/change Devicetree](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#add-change-devicetree) * [Build U-Boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#build-u-boot) * [Boot script](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#boot-script) Was this helpful? sun-brightdesktopmoon boot.script Copy echo 'Linux is booted from boot.scr' setenv bootargs "console=tty0 root=/dev/mmcblk1p2 rootwait" setenv kern_addr 0x80008000 fatload mmc 1:1 ${kern_addr} /zImage fatload mmc 1:1 ${fdt_addr_r} /tegra30-microsoft-surface-rt.dtb bootz ${kern_addr} - ${fdt_addr_r} sun-brightdesktopmoon --- # Linux | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#the-2-ways-of-booting) The 2 ways of booting ---------------------------------------------------------------------------------------------------------------------- Each way of booting has it's own advantages and disadvantages. EFI is easy to boot but has bad performance and power effiency. APX needs more special hardware to boot but performs much better. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#efi-boot) EFI Boot EFI booting is the easier way of booting Linux. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#characteristics) Characteristics * No L2 Cache, no cpuidle (bad performance) * No power related features (no PMIC regulators) #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#requirements) Requirements * [Yahallo](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) * USB drive ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#apx-boot) APX Boot APX booting needs some special hardware. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#characteristics-1) Characteristics * No Wi-Fi * Dynamic Voltage Frequency Scaling (best performance) #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#requirements-1) Requirements * USB A-to-A cable (straight: `D+ -> D+, D- -> D-`) * µSD Card * Linux PC (x86) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#features) Features -------------------------------------------------------------------------------------------- * [Screen](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display) ([Touch](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard/mxt1386e-touchcontroller) , [LVDS Encoder](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/lvds-encoder) , Backlight) * [Touchscreen](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard/mxt1386e-touchcontroller) * [UART A](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart) * [SD Card](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card) (+UHS-I mode) * USB-A host * 2 GB DDR3 RAM * [SPI Bootflash](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi) * [eMMC](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/4-emmc) * HDMI (with audio) * Vol+/-, PWR, Windows Buttons * [Touch-/Type-/Powercover](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid/microsoft-type-touch-cover) (+ hotplug detection) * Hall effect lid sensor (close tCover to suspend the device) * [NCT1008](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/onsemi-nct1008-temperatur) CPU and case temperature sensor * [Wifi](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/3-wifi-sdio-marvell-88w8797) * [Battery / Charger](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/acpi-control-method-battery) * [Audio](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/wolfson-wm8962-audiocodec) : only output (headphone & speakers) * [Sensor Collection / Sensor Hub](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid/mircrosoft-sensor-collection) * [PMIC](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/tps659110-pmic) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#whats-missing) What's Missing? * Hardware Acceleration (3D) * Bluetooth * Camera [PreviousKnown Issueschevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-10/known-issues) [NextDevicetreechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/devicetree) Last updated 4 years ago Was this helpful? * [The 2 ways of booting](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#the-2-ways-of-booting) * [EFI Boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#efi-boot) * [APX Boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#apx-boot) * [Features](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#features) * [What's Missing?](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux#whats-missing) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # 1.8V UART with Voltage divider | Open Surface RT circle-info We recommend buying suitable 1.8V equipment [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#theory-of-voltage-divider) Theory of Voltage divider --------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#simple-voltage-divider) Simple voltage divider Use a [voltage dividerarrow-up-right](https://en.wikipedia.org/wiki/Voltage_divider) to get TX 3.3V / 5V down to 1.8V ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MK9JKsPtteGbXT_gNJ9%252F-MK9MlsEIOP4IziDi9Bg%252FImpedance_voltage_divider.svg.png%3Falt%3Dmedia%26token%3D6b859aff-ce81-4225-b231-96c716f5c90a&width=768&dpr=3&quality=100&sign=d5eb027a&sv=2) Vout\=Z2Z1+Z2∗VinVout = \\frac{Z2}{Z1+Z2} \* VinVout\=Z1+Z2Z2​∗Vin ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#calculating-a-voltage-divider) Calculating a voltage divider 3.3V:Vout\=20kΩ20kΩ+20kΩ∗3.3V\=1.65V3.3V: Vout = \\frac{20k\\Omega}{20k\\Omega + 20k\\Omega} \* 3.3V = 1.65V3.3V:Vout\=20kΩ+20kΩ20kΩ​∗3.3V\=1.65V 5.0V:Vout\=20kΩ20kΩ+47kΩ∗5.0V≈1.5V5.0V: Vout = \\frac{20k\\Omega}{20k\\Omega + 47k\\Omega} \* 5.0V \\approx1.5V5.0V:Vout\=20kΩ+47kΩ20kΩ​∗5.0V≈1.5V circle-exclamation `3.3V: Z1 = 20k; Z2 = 20k 5.0V: z1 = 20k; Z2 = 47k` These values should be safe even if the resistors vary by 5% Test the output Voltage before you send data to 1.8V ports Connection of **Z2 to GND** is very **important**. If it has a bad connection **Vout can get close to Vin** circle-info You need to have a common GND. The easiest method is connecting UART-GND and SRT-GND. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#silicon-labs-cp2102) Silicon Labs CP2102 --------------------------------------------------------------------------------------------------------------------------------------- ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MK9JKsPtteGbXT_gNJ9%252F-MK9OkIQmlol5l7lo71O%252Fuart-setup.jpg%3Falt%3Dmedia%26token%3Dc438c6e2-ce9a-4f5a-bd2c-2d88171720d0&width=768&dpr=3&quality=100&sign=d2e9f147&sv=2) GND connection isn't shown in the picture. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#raspberry-pi) Raspberry Pi ------------------------------------------------------------------------------------------------------------------------- See [Raspberry Pi UART Setup](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup) for further on information on how to setup your RPI. Raspberry Pi's use 3.3V UART. Surface RT only uses 1.8V. Raspberry Pi can receive 1.8V signals without a problem. But the Surface doesn't want to receive a 3.3V Signal. Therefore we need a levelshifter. A simple and cheap solution is to use a voltage divider, as shown above. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MKREZ3er2ENZSQ64XCm%252F-MKRGBziTfKde4e_CmV7%252FUART-RPI-SRT-circuit-diagram.png%3Falt%3Dmedia%26token%3Def4d7b71-b4f8-41cc-b8a8-861a308e12c3&width=768&dpr=3&quality=100&sign=5b12bae9&sv=2) connection example with Voltage divider ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MKREZ3er2ENZSQ64XCm%252F-MKRGJT_KnqJTV-wsugy%252FBreadboard-UART-RPI-SRT.jpg%3Falt%3Dmedia%26token%3D3085fed2-de01-4d45-ab94-b9a9a04b3ef0&width=768&dpr=3&quality=100&sign=f9e82032&sv=2) picture of a breadboard setup [PreviousUARTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart) [NextRaspberry Pi UART-Setupchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup) Last updated 4 years ago Was this helpful? * [Theory of Voltage divider](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#theory-of-voltage-divider) * [Simple voltage divider](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#simple-voltage-divider) * [Calculating a voltage divider](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#calculating-a-voltage-divider) * [Silicon Labs CP2102](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#silicon-labs-cp2102) * [Raspberry Pi](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#raspberry-pi) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UART | Open Surface RT To properly debug Linux a serial console is needed. Tegra30 has 5 hardware UART ports. They are called UART-A/B/C/D/E UART-A is on the ULPI data pins on the SoC ([https://github.com/u-boot/u-boot/blob/master/arch/arm/mach-tegra/tegra30/pinmux.c#L25arrow-up-right](https://github.com/u-boot/u-boot/blob/master/arch/arm/mach-tegra/tegra30/pinmux.c#L25) ) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#uart-a) UART A ------------------------------------------------------------------------------------------------ UART-A TX can be found on [J14](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector) . It transmits data at 1.8V UART-A RX can be found on [J14](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector) . It receives data at 1.8V Below you can see where you can find the UARTA TX, RX pad. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MK0AOUpgYC0nbRaJCRN%252F-MK0ARtAAuE-8fr3mrVT%252Fimage.png%3Falt%3Dmedia%26token%3Db87221bd-1137-4ef4-8b11-4e3b86b9da4b&width=768&dpr=3&quality=100&sign=87175541&sv=2) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#how-to-use-uart) How to use UART circle-info GND from Surface RT must be connected to GND of your UART adapter. If you use fusee gelee your devices are connected via USB-GND. If not you must find suitable GND on sRT. To use UART you need i.e. a usb-uart adapter, a raspberry pi, arduino, etc... A "silicon labs cp210x usb to uart bridge" was used in testing. This is a 3V3 chip which is 5V tolerant. Receiving a 1.8V signal works fine. But sending 3.3V to a 1.8V input is dangerous. triangle-exclamation Be careful when you remove the soldermask (green layer covering the copper). You dont want to cut the trace or short it to any trace below! These pads are very tiny, soldering them is hard without skill and good equipment. It's recommened to use small solid core wire. if you use stranded wire (like i did) only use 2-3 strands. Cut off the rest. Secure your wires with good tape. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#how-we-found-uart-a-tx) How we found UART A TX A Fusée Gelée [payload](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads#spam-uart-a) which initializes UART-A with `Baud: 115200, Bits: 8, Stopbits: 1, Parity:None` was used to find it. After initialisation its spams data to the transmit buffer. We took an oscilloscope and checked that there isn't a pin which provides more than 5V (max of uart adapter). ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MJWPjssvtEvFsjQnnxe%252F-MJWSmIqSWRqKW6RPm0_%252FJ14oscilloscope.jpg%3Falt%3Dmedia%26token%3Dd91e9002-91af-44c9-80a3-ebf3b9cefc6a&width=768&dpr=3&quality=100&sign=1f73b1c&sv=2) Spam UART payload output After this we probed every pin with a usb uart adapter and minicom. After a few seconds we found the corresponding TX-pad. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MJWPjssvtEvFsjQnnxe%252F-MJWPua92jFsojflw3-f%252FfoundUart.png%3Falt%3Dmedia%26token%3D64020772-1600-45fb-91ea-5a325b3495f7&width=768&dpr=3&quality=100&sign=a71356c3&sv=2) * Top left: `dmesg -Tw` show that sRT is booted in APX mode. Also shows if it gets disconnected. * Bottom left: Fusee Gelee launcher with payload and ProductID (see dmesg) * Top right: Minicom output * Bottom right: Fusee gelee payload source code ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#how-we-found-uart-a-rx) How we found UART A RX At this time we got uboot booting. We got output from uboot over UART-A-TX so we only had to bring an TX signal from pc to the RX pad on surfaceRT. One educated guess later we found RX next to TX. Uboot told us that `1` isn't a valid command. after this we tried `help` and and got a solid answer [PreviousJ14 OEM Debug Connectorchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector) [Next1.8V UART with Voltage dividerchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart) Last updated 5 years ago Was this helpful? * [UART A](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#uart-a) * [How to use UART](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#how-to-use-uart) * [How we found UART A TX](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#how-we-found-uart-a-tx) * [How we found UART A RX](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart#how-we-found-uart-a-rx) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Raspberry Pi OS | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MSARarpAu9PYbTaIdmu%252F-MSAS72Rml4cJxGzlsuE%252FRaspiOsOnSurfaceRT.jpeg%3Falt%3Dmedia%26token%3Df64a5228-35d8-4b4e-a105-85416dbd940d&width=768&dpr=3&quality=100&sign=6c79c1b9&sv=2) Raspberry Pi OS booted for the first time on Surface RT circle-exclamation Make sure that Secure boot is disabled before you try to boot Linux. Use this [guide](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#install-raspberry-pi-os) Install Raspberry Pi OS ------------------------------------------------------------------------------------------------------------------------------------------------------------------ Installing Raspberry Pi OS is very easy in comparison to some other distros. It can be done on a Windows or Linux host and therefore is easily accessible for everyone. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#install-on-sd-usb-for-uefi) Install on SD/USB for UEFI 1. Grab all the "standard files" from - ([usb-linux-boot.zip](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#premade-zip) , [zImage](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#grate-driver-linux-kernel) , [tegra30-microsoft-surface-rt-efi.dtb](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#grate-driver-linux-kernel) ). 2. Use [Raspberry Pi OS Imagerarrow-up-right](https://www.raspberrypi.com/software/) (`sudo apt install rpi-imager`) to image a USB drive as you normally would. 3. Place the `efi folder`, `startup.nsh`, `zImage`, and `tegra30-microsoft-surface-rt-efi.dtb` files onto the "boot"/fat32 partition of the USB drive. Confirming any overwrites. 4. Edit the `startup.nsh` file on the USB drive to show as below. For further information about [kernel params](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters) can be found here 5. Download the modules and firmware - [kernel modules](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries#grate-driver-linux-kernel) - and place them in the root directory `/`. This is important. Without modules some features like Wifand i or CPU Temperature Sensor won't work. If you are using Linux you can do this before booting RaspiOS for the first time on your host machine. If you are using Windows you need to boot RaspiOS on Surface RT and copy the modules on from e.g another Fat32 USB to the root filesystem. You need to reboot once to load the modules correctly. Insert the USB Drive into the Surface RT and [Boot to the USB.](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/special-boot-modes#uefi-boot-from-usb) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#install-on-emmc-for-uefi) Install on eMMC for UEFI circle-info You need to install RaspiOS on USB first It is only recommended to install it on eMMC if you really want to use it on eMMC. Otherwise you will wear out your eMMC unnecessarily. Taken from Discord user `Misterobots`: 1. Once Raspberry Pi OS has booted from USB. Go to `Start menu` -> `Accessories` -> `SD Card Copier`. Select the USB drive as the "From". Select the eMMC (mine was MBG4GA) as the "To". Check the box that says "New Partition UUIDs". Click Start 2. Edit the `startup.nsh` (on the eMMC boot partition, that was just copied to) and change the `root=/dev/sda2` to `root=/dev/mmcblk0p2`. Then save. 3. Once the Copy has finished (with no errors), shutdown the Surface RT, remove the USB drive, then power on the Surface RT normally. (do not hold Vol. down) This should get you booted from eMMC with both boot and rootfs on the eMMC. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#todo-after-booting-installing) TODO after booting/installing ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ If you want to install Raspi OS on eMMC do the steps below after booting from eMMC. There is only one thing to do after you can see the desktop. Open the Terminal and enter `sudo raspi-config` Choose `Advanced Options` Choose `Expand Filesystem` Now your SD Card / eMMC is writable and can use all of its space. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#battery-level-in-panel) Battery Level in Panel ---------------------------------------------------------------------------------------------------------------------------------------------------------------- The default plugin always shows 0% charge left. Use the "Battery Monitor" plugin instead. It should be already installed [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#brightness-control) Brightness Control -------------------------------------------------------------------------------------------------------------------------------------------------------- Unlike KDE, GNOME, MATE or XFCE, Raspberry Pi OS running LXDE does not seem to have any plugin to control the brightness. However, it is supported in the kernel level. Download the [rpi-backlightarrow-up-right](https://github.com/linusg/rpi-backlight) tool using \`pip\`. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Frpi-backlight.readthedocs.io%2Fen%2Flatest%2F_images%2Fgui.png&width=768&dpr=3&quality=100&sign=553a3d10&sv=2) Create the following udev rule so that this tool can be run without \`sudo\`. **Reboot**. Now you can run the software with `rpi-backlight-gui`. You can also create a desktop shortcut. Create the file \``` ~/.local/share/applications/rpi-backlight.desktop` `` with the following contents. See [https://rpi-backlight.readthedocs.io/en/latest/usage.html#adding-a-shortcut-to-the-lxde-panelarrow-up-right](https://rpi-backlight.readthedocs.io/en/latest/usage.html#adding-a-shortcut-to-the-lxde-panel) for more details. [PreviouspostmarketOSchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/postmarketos) [NextSimple RootFSchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/simple-rootfs) Last updated 3 years ago Was this helpful? * [Install Raspberry Pi OS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#install-raspberry-pi-os) * [Install on SD/USB for UEFI](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#install-on-sd-usb-for-uefi) * [Install on eMMC for UEFI](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#install-on-emmc-for-uefi) * [TODO after booting/installing](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#todo-after-booting-installing) * [Battery Level in Panel](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#battery-level-in-panel) * [Brightness Control](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os#brightness-control) Was this helpful? sun-brightdesktopmoon Copy fs0: zImage dtb=tegra30-microsoft-surface-rt-efi.dtb root=/dev/sda2 rootwait console=tty0 cpuidle.off=1 # shutdown if something went wrong reset -s Copy pip3 install --user rpi-backlight Copy echo 'SUBSYSTEM=="backlight",RUN+="/bin/chmod 666 /sys/class/backlight/%k/brightness /sys/class/backlight/%k/bl_power"' | sudo tee -a /etc/udev/rules.d/backlight-permissions.rules Copy [Desktop Entry] Version=1.0 Type=Application Terminal=false Name=rpi-backlight GUI Exec=rpi-backlight-gui Icon=/usr/share/icons/HighContrast/256x256/status/display-brightness.png Categories=Utility; sun-brightdesktopmoon --- # UEFI boot | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#prerequisites) Prerequisites ------------------------------------------------------------------------------------------------------------------------ * A Surface RT with secure boot disabled. Visit [Yahallo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot) for more information on how to disable it. * A USB drive, formatted as FAT32 with either MBR or GPT. The partition doesn't require being marked as EFI system partition. Be aware that [FAT32 isn't FAT32](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32) . * A root filesystem/distro on your SD card (recommended)/internal storage/USB. See [root filesystem](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem) . [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#preparing-the-files) Preparing the files ------------------------------------------------------------------------------------------------------------------------------------ circle-info There is a premade ZIP below. There are [prebuilt binaries](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) . Most people use UEFI shell to chainload an EFI linux kernel. Using UEFI shell gives the option to easily specify and modify the kernel command line. file-download 721KB [bootarm.efi](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeH-hiP_AXK_6RIHdE2%2F-MeH0KWUIYWAW2iObAa1%2Fbootarm.efi?alt=media&token=5fb64768-51d1-4093-90be-a10a882142f9) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeH-hiP_AXK_6RIHdE2%2F-MeH0KWUIYWAW2iObAa1%2Fbootarm.efi?alt=media&token=5fb64768-51d1-4093-90be-a10a882142f9) UEFI shell You may want to use different bootloaders, like [GRUB](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/compiling-grub2) . Place UEFI shell onto your bootable USB drive (as efi/boot/bootarm.efi) and place the zImage and the tegra30-microsoft-surface-rt-efi.dtb files onto the root of your usb drive. You will need to create a startup script for UEFI shell: startup.nsh Copy fs0: # add initrd= if you want to boot a ramdisk image # replace console=tty0 with console=ttyS0,115200 if you want serial output on UART A zImage dtb=tegra30-microsoft-surface-rt-efi.dtb root=/dev/mmcblk1p2 console=tty0 cpuidle.off=1 # shutdown if something went wrong reset -s You may want to change the line that begins with `zImage`. It is the kernel command line. `root=/dev/mmcblk1p2` is the second partition of the sdcard, change this if you want to use a different device/partition. [RPI OS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) is a recommended distro, as it runs smooth `root=/dev/mmcblk0p2` is a location set to internal storage (eMMC) second partition, set it to this after cloning the installation over to internal storage. `root=/dev/sda2` is a second partition for USB only boot, set it to this if you want to USB boot only circle-info See [Kernel parameters](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters) for further information. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#premade-zip) Premade ZIP file-archive 288KB [usb-linux-boot.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-Miv2LXQMtgfQZB7tUEL%2F-Miv387j-uOAVCFsjVDJ%2Fusb-linux-boot.zip?alt=media&token=d2503480-851d-4203-b3cb-30e40d0b9ba2) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-Miv2LXQMtgfQZB7tUEL%2F-Miv387j-uOAVCFsjVDJ%2Fusb-linux-boot.zip?alt=media&token=d2503480-851d-4203-b3cb-30e40d0b9ba2) Extract this ZIP to your USB, and add your zImage and device tree to it. You can find precompiled binaries [here](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) . [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#booting-linux) Booting linux ------------------------------------------------------------------------------------------------------------------------ With the USB drive set up, a distro installed and secure boot disabled, you are ready to boot linux. 1. Shut the device off 2. Plug in your USB drive 3. Boot from the USB 1. Hold the volume down button 2. Press the power button for a second 3. Wait until the surface logo appears 4. Release volume down 4. You should see kernel logs onscreen (after a short while (15 seconds), wait for 1 minute if nothing happens try again) If you have any issues, feel free to contact us on [discordarrow-up-right](https://discord.gg/tAxvvVC) . [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#installing-boot-files-on-internal-storage) Installing boot files on internal storage -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- With the method shown above, you will need your USB always on hand to boot linux. You can also install these boot files on the internal storage. The easiest method is to just clean the windows boot files from the EFI partition, and replace them with the contents of your USB drive. triangle-exclamation This will make you unable to boot Windows! circle-info It is possible to make Windows and Linux dual-boot. For example, you can use GRUB. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#using-uefi-shell-to-copy-the-files) Using UEFI shell to copy the files Replace the contents of your startup.nsh on the USB with the following: After booting, it will copy the devicetree, zImage and the startup-system.nsh over to the EFI partition on the internal storage. Fill your startup-system.nsh with the linux boot commands. (The commands you normally have in your startup.nsh) This method is also useful for updating the device tree and zImage, if you already have existing linux files there. [PreviousKernel parameterschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/kernel-parameters) [NextAPX bootchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot) Last updated 3 years ago Was this helpful? * [Prerequisites](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#prerequisites) * [Preparing the files](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#preparing-the-files) * [Premade ZIP](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#premade-zip) * [Booting linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#booting-linux) * [Installing boot files on internal storage](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#installing-boot-files-on-internal-storage) * [Using UEFI shell to copy the files](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#using-uefi-shell-to-copy-the-files) Was this helpful? sun-brightdesktopmoon Copy fs0: cp fs1:\efi/boot/bootarm.efi fs1:\efi/boot/bootarm.efi.backup >> log.txt cp efi/boot/bootarm.efi fs1:\efi/boot/bootarm.efi >> log.txt cp tegra30-microsoft-surface-rt-efi.dtb fs1: >> log.txt cp zImage fs1: >> log.txt cp startup-system.nsh fs1:\startup.nsh >> log.txt reset -s sun-brightdesktopmoon --- # Firmware | Open Surface RT The Boot rom starts and loads the firmware from a SPI-Flash. [PreviousBatterychevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery) [NextExtract Firmwarechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Decrypt Firmware | Open Surface RT The following script processes a SPI dump. It extracts and decrypts the BCT & Bootloader Decrypt BCT Copy #!/bin/bash echo "Extract BCT/Bootloader from SPI flash" dd if=mtd0Original_CTS.bin of=BCT_Block_enc.bin bs=1 count=8192 #extract the BCT block dd if=mtd0Original_CTS.bin of=Bootloader_Block_enc.bin bs=1 count=520192 skip=1048576 #extract the Bootloader block dd if=BCT_Block_enc.bin of=BCT_enc.bin bs=1 count=6128 #extract BCT from block dd if=Bootloader_Block_enc.bin of=Bootloader_enc.bin bs=1 count=517472 #extract Bootloader from block dd if=BCT_enc.bin of=BCT_trimmed_enc.bin bs=1 skip=16 #extract BCT without hash dd if=BCT_enc.bin of=BCT_hash.bin bs=1 count=16 #extract BCT hash echo "" echo "decrypting Files" openssl aes-128-cbc -d -K deadbeefdeadc0dedeadd00dfee1dead -iv 00000000000000000000000000000000 -nopad -nosalt -in BCT_enc.bin -out BCT_dec.bin #decrypt BCT openssl aes-128-cbc -d -K deadbeefdeadc0dedeadd00dfee1dead -iv 00000000000000000000000000000000 -nopad -nosalt -in Bootloader_enc.bin -out Bootloader_dec.bin #decrypt Bootloader echo "" echo "Extracted BCT hash" xxd -ps BCT_hash.bin echo "Calculated BCT hash" openssl dgst -mac cmac -macopt cipher:aes-128-cbc -macopt hexkey:deadbeefdeadc0dedeadd00dfee1dead BCT_trimmed_enc.bin #hash of enc-BCT #calc BCT hash echo "" echo "Extracted Bootloader hash" bct_dump BCT_dec.bin | grep AES echo "Calculated Bootloader hash" openssl dgst -mac cmac -macopt cipher:aes-128-cbc -macopt hexkey:deadbeefdeadc0dedeadd00dfee1dead Bootloader_enc.bin #hash of enc-Bootloader #calc Bootloader hash echo "" echo "remove temp files" rm BCT_Block_enc.bin rm BCT_enc.bin rm BCT_trimmed_enc.bin rm Bootloader_Block_enc.bin rm Bootloader_enc.bin [PreviousExtract Firmwarechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash) [NextEncrypt Firmwarechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/encrypt-firmware) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # RPMB partition on EMMC | Open Surface RT This part of the emmc is meant to be only read and written by trusted software. As it turns out you can read this partition on some devices. It is possible if you have a "CMD12" emmc. If it is a "CMD13" emmc it doesn't work. Read operations happen from within linux, also information about the emmc is gathered there, use the following commands: Copy sudo mmc extcsd read /dev/mmcblk1rpmb > extcsd.txt sudo mmc rpmb read-block /dev/mmcblk1rpmb 0 128 rpmb.img The extcsd.txt file will contain extcsd information of your emmc, the rpmb.img file will contain the RPMB dump, if dumping works. If you happen to do this process contact @utf-4096 on our discord server, as he is interested in this information (if dumping worked and in the extcsd info). circle-info Current (May 2021) sample size of the above information is 3, so it may not apply to you. [PreviousBCTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct) [NextUEFIchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Boot Linux | Open Surface RT To boot Linux on Surface RT we use the Fusée Gelée cold boot exploit. See [Fusée Gelée](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee) for further information. triangle-exclamation Read all pages of the Linux topic carefully before you try to boot Linux [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#boot-linux-via-fusee-gelee) Boot Linux via Fusée Gelée ------------------------------------------------------------------------------------------------------------------------------------------------------------ ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#prerequisite) Prerequisite * [Extract BCT](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/bct-table) from your device #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#diy) Diy * [Build U-Boot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot) with correct devicetree * Create a [U-Boot boot script](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#boot-script) * [Build Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/configure-and-build) with correct devicetree * [Build Root Filesystem](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/simple-rootfs) for ARM32 * Create/Get [BootToolChain](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee) #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#prebuild-binary) Prebuild binary * [Uboot](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/binarys#u-boot) * [Linux kernel](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/kernel/prebuilt-binaries) * [bootscript.scr](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/binarys#boot-script) * [Get Root Filesystem](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#boot-it-first-time) Boot it first time 1. [Prepare SD Card](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/prepare-sd-card) 2. Place zImage, devicetree and [boot.scr](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#boot-script) on first partition 3. extract [rootfs.tar](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/simple-rootfs) on second partition 4. Insert SD Card into the SurfaceRT 5. Go to to your [BootToolChain](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee) directory 6. [Extract BCT](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/bct-table) 7. place your U-Boot '[u-boot-dtb-tegra.bin](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/uboot#build-u-boot) ' in ./u-boot 8. [Boot Surface RT into RCM mode](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#entering-apx-mode) 9. Send UBoot to Surface RT use [Script](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee#premade-package) or [commands](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/untitled) 10. If you have [UART access](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart) you should see U-Boot boot process 11. Linux should be booted and be accessible via UART and/or show HDMI/Screen Console 12. Enjoy and fix issues. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#boot-it-again) Boot it again 1. [Boot Surface RT into RCM](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/apx-mode-usb-debugging#entering-apx-mode) 2. Send UBoot to Surface RT using [Script](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee#premade-package) or [commands](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/untitled) 3. If you have [UART access](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart) you should see U-Boot boot process 4. Linux should be booted and be accessible via UART and/or show HDMI Console 5. Enjoy and fix issues. [PreviousNvFlash (Modified)chevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/untitled) [NextBinarieschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux/binarys) Last updated 4 years ago Was this helpful? * [Boot Linux via Fusée Gelée](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#boot-linux-via-fusee-gelee) * [Prerequisite](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#prerequisite) * [Boot it first time](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#boot-it-first-time) * [Boot it again](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/boot-linux#boot-it-again) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Encrypt Firmware | Open Surface RT Copy #!/bin/bash echo "Build FlashImage from BCT/Bootloader" # Change these 3 variables BCT= Bootloader= key= cp $BCT tmp_bct.bin cp $Bootloader tmp_bootloader.bin ############################################################################### ########### BOOTLOADER ######################################################## ############################################################################### #pad bootloader to be 16Byte aligned bootloaderLength=$(stat --printf="%s" tmp_bootloader.bin) while [ $((bootloaderLength%16)) -ne 0 ]; do echo -n -e \\x00 >> tmp_bootloader.bin bootloaderLength=$(stat --printf="%s" tmp_bootloader.bin) done # encrypt bootloader echo "test" openssl aes-128-cbc -e -K $key -iv 00000000000000000000000000000000 -nopad -nosalt -in tmp_bootloader.bin -out tmp_bootloader_enc.bin #-nopad echo "test" # calc bootloader hash of encrypted bootloader bootloaderHash=$(openssl dgst -mac cmac -macopt cipher:aes-128-cbc -macopt hexkey:$key tmp_bootloader_enc.bin | cut -d' ' -f2) # get length of encrypted bootloader bootloaderLength=$(stat --printf="%s" tmp_bootloader_enc.bin) # set bootloader load address bootloaderLoadAddress=0x80108000 # set bootloader entry point bootloaderEntryPoint=0x80108000 # Swap endianess of Length, LoadAddress, EntryPoint v=$(printf "%08x" $bootloaderLength) bootloaderLength=${v:6:2}${v:4:2}${v:2:2}${v:0:2} v=$(printf "%08x" $bootloaderLoadAddress) bootloaderLoadAddress=${v:6:2}${v:4:2}${v:2:2}${v:0:2} v=$(printf "%08x" $bootloaderEntryPoint) bootloaderEntryPoint=${v:6:2}${v:4:2}${v:2:2}${v:0:2} # add bootloader data to BCT echo $bootloaderLoadAddress | xxd -r -p | dd conv=notrunc of=tmp_bct.bin seek=3940 bs=1 echo $bootloaderEntryPoint | xxd -r -p | dd conv=notrunc of=tmp_bct.bin seek=3944 bs=1 echo $bootloaderHash | xxd -r -p | dd conv=notrunc of=tmp_bct.bin seek=3952 bs=1 echo $bootloaderLength | xxd -r -p | dd conv=notrunc of=tmp_bct.bin seek=3936 bs=1 #create bootloader block dd if=/dev/zero of=tmp_bootloader_block.bin bs=1 count=520192 #put bootloader in block dd conv=notrunc if=tmp_bootloader_enc.bin of=tmp_bootloader_block.bin bs=1 ############################################################################### ########### BCT ############################################################### ############################################################################### # remove HASH from BCT dd if=tmp_bct.bin of=tmp_bct_trimmed.bin bs=1 skip=16 # encrypt BCT openssl aes-128-cbc -e -K $key -iv 00000000000000000000000000000000 -nopad -nosalt -in tmp_bct_trimmed.bin -out tmp_bct_trimmed_enc.bin # hash encrypted BCT BCT_hash=$(openssl dgst -mac cmac -macopt cipher:aes-128-cbc -macopt hexkey:$key tmp_bct_trimmed_enc.bin | cut -d' ' -f2) #create BCT_block image dd if=/dev/zero of=tmp_bct_block.bin bs=1 count=8192 #put hash in Image echo $BCT_hash | xxd -r -p | dd conv=notrunc of=tmp_bct_block.bin seek=0 bs=1 #put BCT in Image dd conv=notrunc if=tmp_bct_trimmed_enc.bin of=tmp_bct_block.bin seek=16 bs=1 ############################################################################### ########### Flash Image######################################################## ############################################################################### # create spi flash image with ones/zeros dd if=/dev/zero bs=512 count=8192 | tr '\000' '\377' > flashImage.bin # to proof that dumped image is same as generated #dd if=/dev/zero of=flashImage.bin bs=512 count=8192 # for flashing #put BCT_Block in image dd conv=notrunc if=tmp_bct_block.bin of=flashImage.bin seek=0 bs=1 #put Bootloader_block in image dd conv=notrunc if=tmp_bootloader_block.bin of=flashImage.bin seek=1048576 bs=1 ############################################################################### ########### Remove Tmp files ################################################## ############################################################################### rm tmp_*.bin [PreviousDecrypt Firmwarechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/extract-and-decrypt-orignal-firmware) [NextBCTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # BCT | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#what-is-it-and-how-to-get-it) What is it and how to get it ------------------------------------------------------------------------------------------------------------------------------------------- The boot configuration table contains information about which bootloader to boot. On the Surface RT it is stored on the SPI flash. Go to [SPI flash](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash) , to dump it directly from SPI. Or do it with nvflash (recommended): `sudo ./utils/nvflash_v1.13.87205 --getbct --bct surfacert.bin --configfile ./utils/flash.cfg` [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#decompiling-and-compiling) Decompiling and Compiling ------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#decompiling) Decompiling To decompile your BCT into a configuration file, use the tool bct\_dump. Usage: `bct_dump ` Tip you can add `> ` to reroute the output to a file. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#compiling) Compiling #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#compiling-configuration-file) Compiling configuration file You can compile your bct.cfg file by using the tool cbootimage. Usage: `cbootimage -s tegra30 -t 30 -gbct ` Example: `cbootimage -s tegra30 -t 30 -gbct surfacert-custom.bct.cfg surfacert-custom.bct` #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#adding-a-bootloader-to-bct) Adding a Bootloader to BCT To generate a image file with your BCT and provided bootloader, again use cbootimage. Usage: `cbootimage -d -s tegra30 -t 30 ` Example: `cbootimage -d -s tegra30 -t 30 surfacert.config surfacert.output` is a file controlling how the .img file should be created. It has the following structure: Copy # Refernence: https://github.com/NVIDIA/cbootimage-configs/blob/master/tegra30/nvidia/cardhu/cardhu-a05-2gb-emmc.img.cfg Version = 0x00000001; Bctcopy = 1; Bctfile = ; BootLoader = ,,,Complete; Example: Doing this will create a image file of your BCT and the bootloader you provided. The BCT will automatically updated with the correct sizes and hashes. [PreviousEncrypt Firmwarechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/encrypt-firmware) [NextRPMB partition on EMMCchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/rpmb-partition-on-emmc) Last updated 5 years ago Was this helpful? * [What is it and how to get it](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#what-is-it-and-how-to-get-it) * [Decompiling and Compiling](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#decompiling-and-compiling) * [Decompiling](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#decompiling) * [Compiling](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/bct#compiling) Was this helpful? sun-brightdesktopmoon Copy Version = 0x00000001; Bctcopy = 1; Bctfile = surfacert-custom.bct; BootLoader = mtd0-bootloader,0x80808000,0x80808000,Complete; sun-brightdesktopmoon --- # Raspberry Pi UART-Setup | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup#configure-your-raspberry-pi) Configure your Raspberry Pi ------------------------------------------------------------------------------------------------------------------------------------------------------------------ To enable the UART on your Raspberry Pi to be used as host you need to configure it: `sudo raspi-config` Go to `5 - interfacing options` Go to `P6 - serial` `Would you like a login shell to be accessible over serial?` Answer: 'No' `Would you like the serial port hardware to be enabled?` Answer: 'Yes' Reboot your Raspberry Pi. circle-info See [Raspberry Pi](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart#raspberry-pi) for information on how to physically connect your RPI and your SRT. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup#open-a-serial-console) Open a serial console ------------------------------------------------------------------------------------------------------------------------------------------------------ To establish a UART-Connection to the Surface RT use RPI2: `minicom -b 115200 -D /dev/ttyAMA0` RPI\_Zero `minicom -b 115200 -D /dev/ttyS0` circle-info To escape from minicom use STRG+A and then X. Further information: [https://www.raspberrypi.org/documentation/configuration/uart.mdarrow-up-right](https://www.raspberrypi.org/documentation/configuration/uart.md) [Previous1.8V UART with Voltage dividerchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/diy-1v8-uart) [NextGPIOschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios) Last updated 4 years ago Was this helpful? * [Configure your Raspberry Pi](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup#configure-your-raspberry-pi) * [Open a serial console](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup#open-a-serial-console) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # PinMux | Open Surface RT Pinmux dump taken from UEFI boot file-download 10KB [pinmuxUEFIShell.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKneNIwce6rJD35mFdJ%2F-MKne_hOrA4-w1V41S3_%2FpinmuxUEFIShell.txt?alt=media&token=94b77822-8a5e-4f28-8375-c3cedf4a6ae6) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKneNIwce6rJD35mFdJ%2F-MKne_hOrA4-w1V41S3_%2FpinmuxUEFIShell.txt?alt=media&token=94b77822-8a5e-4f28-8375-c3cedf4a6ae6) [PreviousDevice Tableschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables) [NextCompiling GRUB2chevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/compiling-grub2) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # GPIOs in Linux | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios/gpios-in-linux#getting-the-state-of-gpio-in-linux) Getting the state of GPIO in linux ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ You need to add `CONFIG_DEBUG_FS=y`into your kernel .config file. After that you can run `mount -t debugfs debugfs /sys/kernel/debug` To view the state of all the available GPIO pins type `cat /sys/kernel/debug/tegra_gpio` [Previousdecode - Pin number to Letterchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios/decode-pin-number-to-letter) [NextIC'schevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Extract Firmware | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#dumping-the-spi-flash-from-linux) Dumping the SPI flash from Linux --------------------------------------------------------------------------------------------------------------------------------------------------------- Dump the SPI flash by using the linux command line tool `dd`. Command: `dd if=/dev/mtd0 of=mtd0` This will dump the SPI flash to the file mtd0. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#device-tree-entry-for-the-spi) Device tree entry for the SPI This is what the SPI flash device tree entry looks like. Copy spi@7000da00 { status = "okay"; spi-max-frequency = <25000000>; spi-flash@1 { compatible = "winbond,w25q32", "jedec,spi-nor"; reg = <1>; spi-max-frequency = <20000000>; }; }; [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#the-dump) The dump --------------------------------------------------------------------------------------------------------- The first 6128 bytes are the BCT, encrypted with your platform key. The loader for UEFI is located at 0x0100000. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#how-we-can-tell) How we can tell To check it yourself, 1. [Dump your SPI flash](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#dumping-with-linux) 2. [Get your BCT with nvflash](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee#execute-the-exploit) 3. [Get your platform key](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/tegra-soc-boot-process/fusee-gelee/payloads/dump-platform-key-sbk) To encrypt the BCT you got form nvflash use the following script, and replace with your platform key. Example usage: `./encrypt.sh surfacert.bct surfacert-encrypted.bct` To check if it is really the same, create a hexdump of your SPI flash dump and encrypted BCT. Your encrypted BCT should match the first 6128 bytes of the SPI flash dump. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#downloads) Downloads triangle-exclamation The files are encrypted and **board specific**. You cant use them on your Surface RT A dump from @Leander's Surface RT. Here is the platform key of the used Surface RT: `28a5d126adf421e6a39bfc8f7ff32308` #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#leanders-blob) Leanders blob file-download 4MB [mtd0](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MN4VtKYSOwXhzJhhiGM%2F-MN4WipHATobSFwq8l6N%2Fmtd0?alt=media&token=1465b95e-6319-41b0-a90f-79949883df00) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MN4VtKYSOwXhzJhhiGM%2F-MN4WipHATobSFwq8l6N%2Fmtd0?alt=media&token=1465b95e-6319-41b0-a90f-79949883df00) SPI-flash-dump file-download 6KB [surfacert-encrypted.bct](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MN4n3cO3U7lqMe7FNIT%2F-MN4n9lGHthA5s0lnLQw%2Fsurfacert-encrypted.bct?alt=media&token=8bd0d17d-a80a-4f61-93e2-617350712dd8) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MN4n3cO3U7lqMe7FNIT%2F-MN4n9lGHthA5s0lnLQw%2Fsurfacert-encrypted.bct?alt=media&token=8bd0d17d-a80a-4f61-93e2-617350712dd8) BCT-encrypted file-download 6KB [surfacert.bin](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MN4n3cO3U7lqMe7FNIT%2F-MN4nTfAwtw5-O3h0Emh%2Fsurfacert.bin?alt=media&token=3562600d-2e50-4f18-861d-30c7dbfeea74) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MN4n3cO3U7lqMe7FNIT%2F-MN4nTfAwtw5-O3h0Emh%2Fsurfacert.bin?alt=media&token=3562600d-2e50-4f18-861d-30c7dbfeea74) BCT-from-nvflash #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#cts-blob) CTS blob file-download 4MB [mtd0Original\_CTS.bin](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MNS8o6SfgppJWtQ6RqP%2F-MNT1ZuOh0YstEwGw3NS%2Fmtd0Original_CTS.bin?alt=media&token=1a36305e-fcdf-4205-935b-38373454ac59) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MNS8o6SfgppJWtQ6RqP%2F-MNT1ZuOh0YstEwGw3NS%2Fmtd0Original_CTS.bin?alt=media&token=1a36305e-fcdf-4205-935b-38373454ac59) [PreviousFirmwarechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware) [NextDecrypt Firmwarechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/extract-and-decrypt-orignal-firmware) Last updated 5 years ago Was this helpful? * [Dumping the SPI flash from Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#dumping-the-spi-flash-from-linux) * [The dump](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#the-dump) * [How we can tell](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#how-we-can-tell) * [Downloads](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/spi-flash#downloads) Was this helpful? sun-brightdesktopmoon Copy #!/bin/sh cut_bct=`tempfile` dec_bct=`tempfile` dd if=$1 of=$cut_bct bs=16 skip=1 openssl aes-128-cbc -K -iv 00000000000000000000000000000000 -nopad -nosalt -in $cut_bct -out $dec_bct dd if=$1 of=$2 bs=16 count=1 dd if=$dec_bct of=$2 bs=16 seek=1 rm -f $cut_bct $dec_bct sun-brightdesktopmoon --- # Memory Mapping | Open Surface RT `lsefimmap` on SurfaceRT Good reading - [https://people.kernel.org/linusw/how-the-arm32-kernel-startsarrow-up-right](https://people.kernel.org/linusw/how-the-arm32-kernel-starts) Surface RT UEFI Memory Map Copy Type Start End # Pages Attributes RT_Code 0000000080000000-0000000082000FFF 0000000000002001 800000000000000F Reserved 0000000082001000-0000000082005FFF 0000000000000005 000000000000000F BS_Data 0000000082006000-0000000082006FFF 0000000000000001 000000000000000F LoaderData 0000000082007000-0000000082009FFF 0000000000000003 000000000000000F Available 000000008200A000-000000008200BFFF 0000000000000002 000000000000000F LoaderData 000000008200C000-000000008200FFFF 0000000000000004 000000000000000F BS_Data 0000000082010000-000000008218BFFF 000000000000017C 000000000000000F LoaderData 000000008218C000-0000000082231FFF 00000000000000A6 000000000000000F Available 0000000082232000-0000000082233FFF 0000000000000002 000000000000000F LoaderData 0000000082234000-0000000082257FFF 0000000000000024 000000000000000F Available 0000000082258000-000000008228BFFF 0000000000000034 000000000000000F LoaderData 000000008228C000-000000008238BFFF 0000000000000100 000000000000000F Available 000000008238C000-000000008240BFFF 0000000000000080 000000000000000F LoaderData 000000008240C000-000000008240CFFF 0000000000000001 000000000000000F Available 000000008240D000-0000000082414FFF 0000000000000008 000000000000000F LoaderData 0000000082415000-0000000082420FFF 000000000000000C 000000000000000F Available 0000000082421000-0000000082430FFF 0000000000000010 000000000000000F LoaderData 0000000082431000-000000008243CFFF 000000000000000C 000000000000000F Available 000000008243D000-00000000FB499FFF 000000000007905D 000000000000000F LoaderData 00000000FB49A000-00000000FB61EFFF 0000000000000185 000000000000000F LoaderCode 00000000FB61F000-00000000FB710FFF 00000000000000F2 000000000000000F Available 00000000FB711000-00000000FB744FFF 0000000000000034 000000000000000F BS_Data 00000000FB745000-00000000FB75BFFF 0000000000000017 000000000000000F Available 00000000FB75C000-00000000FB764FFF 0000000000000009 000000000000000F BS_Data 00000000FB765000-00000000FB765FFF 0000000000000001 000000000000000F Available 00000000FB766000-00000000FB767FFF 0000000000000002 000000000000000F BS_Data 00000000FB768000-00000000FC3D7FFF 0000000000000C70 000000000000000F Reserved 00000000FC3D8000-00000000FC3D9FFF 0000000000000002 000000000000000F BS_Data 00000000FC3DA000-00000000FC3E3FFF 000000000000000A 000000000000000F ACPI_Recl 00000000FC3E4000-00000000FC3E4FFF 0000000000000001 000000000000000F BS_Data 00000000FC3E5000-00000000FC3FFFFF 000000000000001B 000000000000000F Unusable 00000000FC400000-00000000FD3FFFFF 0000000000001000 000000000000000F BS_Code 00000000FD400000-00000000FD528FFF 0000000000000129 000000000000000F BS_Data 00000000FD529000-00000000FD5B0FFF 0000000000000088 000000000000000F ACPI_Recl 00000000FD5B1000-00000000FD5B1FFF 0000000000000001 000000000000000F BS_Data 00000000FD5B2000-00000000FD5B7FFF 0000000000000006 000000000000000F LoaderData 00000000FD5B8000-00000000FD5BBFFF 0000000000000004 000000000000000F BS_Data 00000000FD5BC000-00000000FD5C2FFF 0000000000000007 000000000000000F ACPI_Recl 00000000FD5C3000-00000000FD5C5FFF 0000000000000003 000000000000000F BS_Data 00000000FD5C6000-00000000FD5C9FFF 0000000000000004 000000000000000F BS_Code 00000000FD5CA000-00000000FD60EFFF 0000000000000045 000000000000000F BS_Data 00000000FD60F000-00000000FD610FFF 0000000000000002 000000000000000F BS_Code 00000000FD611000-00000000FD611FFF 0000000000000001 000000000000000F BS_Data 00000000FD612000-00000000FD612FFF 0000000000000001 000000000000000F BS_Code 00000000FD613000-00000000FD633FFF 0000000000000021 000000000000000F BS_Data 00000000FD634000-00000000FD637FFF 0000000000000004 000000000000000F BS_Code 00000000FD638000-00000000FD644FFF 000000000000000D 000000000000000F BS_Data 00000000FD645000-00000000FD646FFF 0000000000000002 000000000000000F BS_Code 00000000FD647000-00000000FD647FFF 0000000000000001 000000000000000F BS_Data 00000000FD648000-00000000FD66EFFF 0000000000000027 000000000000000F BS_Code 00000000FD66F000-00000000FD676FFF 0000000000000008 000000000000000F BS_Data 00000000FD677000-00000000FD677FFF 0000000000000001 000000000000000F RT_Code 00000000FD678000-00000000FD686FFF 000000000000000F 800000000000000F BS_Data 00000000FD687000-00000000FD687FFF 0000000000000001 000000000000000F BS_Code 00000000FD688000-00000000FD688FFF 0000000000000001 000000000000000F BS_Data 00000000FD689000-00000000FD68AFFF 0000000000000002 000000000000000F BS_Code 00000000FD68B000-00000000FD730FFF 00000000000000A6 000000000000000F RT_Data 00000000FD731000-00000000FD7B0FFF 0000000000000080 800000000000000F BS_Code 00000000FD7B1000-00000000FD7CCFFF 000000000000001C 000000000000000F BS_Data 00000000FD7CD000-00000000FD7CEFFF 0000000000000002 000000000000000F BS_Code 00000000FD7CF000-00000000FD7D4FFF 0000000000000006 000000000000000F BS_Data 00000000FD7D5000-00000000FD8DFFFF 000000000000010B 000000000000000F ACPI_Recl 00000000FD8E0000-00000000FD8EBFFF 000000000000000C 000000000000000F BS_Data 00000000FD8EC000-00000000FD906FFF 000000000000001B 000000000000000F ACPI_Recl 00000000FD907000-00000000FD907FFF 0000000000000001 000000000000000F Reserved 00000000FD908000-00000000FD908FFF 0000000000000001 000000000000000F BS_Data 00000000FD909000-00000000FD909FFF 0000000000000001 000000000000000F ACPI_Recl 00000000FD90A000-00000000FD90BFFF 0000000000000002 000000000000000F ACPI_NVS 00000000FD90C000-00000000FD90CFFF 0000000000000001 000000000000000F ACPI_Recl 00000000FD90D000-00000000FD90DFFF 0000000000000001 000000000000000F BS_Data 00000000FD90E000-00000000FD90EFFF 0000000000000001 000000000000000F ACPI_Recl 00000000FD90F000-00000000FD90FFFF 0000000000000001 000000000000000F BS_Data 00000000FD910000-00000000FE2EBFFF 00000000000009DC 000000000000000F ACPI_Recl 00000000FE2EC000-00000000FE2ECFFF 0000000000000001 000000000000000F BS_Data 00000000FE2ED000-00000000FE312FFF 0000000000000026 000000000000000F Available 00000000FE313000-00000000FE31CFFF 000000000000000A 000000000000000F BS_Data 00000000FE31D000-00000000FEED4FFF 0000000000000BB8 000000000000000F BS_Code 00000000FEED5000-00000000FF064FFF 0000000000000190 000000000000000F RT_Code 00000000FF065000-00000000FF08CFFF 0000000000000028 800000000000000F RT_Data 00000000FF08D000-00000000FF0DCFFF 0000000000000050 800000000000000F BS_Data 00000000FF0DD000-00000000FF0DDFFF 0000000000000001 000000000000000F BS_Code 00000000FF0DE000-00000000FF0F4FFF 0000000000000017 000000000000000F BS_Data 00000000FF0F5000-00000000FF7DAFFF 00000000000006E6 000000000000000F Available 00000000FF7DB000-00000000FFED2FFF 00000000000006F8 000000000000000F Reserved 00000000FFED3000-00000000FFED7FFF 0000000000000005 000000000000000F BS_Data 00000000FFED8000-00000000FFEDBFFF 0000000000000004 000000000000000F Available 00000000FFEDC000-00000000FFEDFFFF 0000000000000004 000000000000000F BS_Data 00000000FFEE0000-00000000FFEFFFFF 0000000000000020 000000000000000F MMIO 0000000040000000-000000004003FFFF 0000000000000040 8000000000000001 MMIO 0000000060005000-0000000060007FFF 0000000000000003 8000000000000001 MMIO 000000006000D000-000000006000DFFF 0000000000000001 8000000000000001 MMIO 0000000070003000-0000000070003FFF 0000000000000001 8000000000000001 MMIO 000000007000D000-000000007000EFFF 0000000000000002 8000000000000001 MMIO 0000000078000000-0000000078000FFF 0000000000000001 8000000000000001 Reserved : 13 Pages (53,248 Bytes) LoaderCode: 242 Pages (991,232 Bytes) LoaderData: 883 Pages (3,616,768 Bytes) BS_Code : 1,046 Pages (4,284,416 Bytes) BS_Data : 11,494 Pages (47,079,424 Bytes) RT_Code : 8,248 Pages (33,783,808 Bytes) RT_Data : 208 Pages (851,968 Bytes) ACPI_Recl : 23 Pages (94,208 Bytes) ACPI_NVS : 1 Pages (4,096 Bytes) MMIO : 72 Pages (294,912 Bytes) MMIO_Port : 0 Pages (0 Bytes) PalCode : 0 Pages (0 Bytes) Available : 497,778 Pages (2,038,898,688 Bytes) Persistent: 0 Pages (0 Bytes) -------------- Total Memory: 2,030 MB (2,129,604,608 Bytes) file-download 16KB [memmap.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRQ5sWdPK8lFlOM9m8%2F-MJRQQQMgpk1leKwIVBp%2Fmemmap.txt?alt=media&token=76273fb6-edaf-4c77-97c2-23e1b4bc2b4a) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRQ5sWdPK8lFlOM9m8%2F-MJRQQQMgpk1leKwIVBp%2Fmemmap.txt?alt=media&token=76273fb6-edaf-4c77-97c2-23e1b4bc2b4a) [PreviousXSDTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/xsdt) [NextDevice Tableschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # WDSA | Open Surface RT Contains information about tCover and gets loaded when the tCover detect Interrupt triggers. Tables gets unloaded if tCover gets disconnected [PreviousSSDTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt) [NextMADT / APICchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Lenovo Ideapad Yoga 11 | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#key-combinations) Key-Combinations -------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#booting-from-usb) Booting from USB To boot from a USB drive follow these instructions: * Hold Volume Up and the Windows button below the screen (not on the keyboard) and press the power button once. * Release both keys once the Lenovo logo pops up ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#booting-into-apx-mode) Booting into APX mode To boot into APX mode follow this: * Hold Volume Up and Rotation lock button (right side/edge) and press the power button once. * Once Caps Lock lights up you can release the buttons. [PreviousBatterychevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/battery) [NextLinuxchevron-right](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux) Last updated 4 years ago Was this helpful? * [Key-Combinations](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#key-combinations) * [Booting from USB](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#booting-from-usb) * [Booting into APX mode](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#booting-into-apx-mode) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # 4 - eMMC | Open Surface RT 32/64GB internal eMMC [Previous3 - WIFI SDIO: Marvell: 88W8797chevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/3-wifi-sdio-marvell-88w8797) [NextI2C deviceschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # MMC | Open Surface RT [1 - μSD Cardchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card) [3 - WIFI SDIO: Marvell: 88W8797chevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/3-wifi-sdio-marvell-88w8797) [4 - eMMCchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/4-emmc) [PreviousSPI Flashchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi) [Next1 - μSD Cardchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Compiling GRUB2 | Open Surface RT circle-exclamation [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/compiling-grub2#we-have-a-working-uboot-and-kernel-work-on-uefi-grub-booting-is-deprecated-for-the-moment) We have a working uBoot, and Kernel, work on UEFI GRUB booting is deprecated for the moment ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- We will use a pre-patched GRUB from [https://github.com/coherixmatts/grub-2.04arrow-up-right](https://github.com/coherixmatts/grub-2.04) as this will work out of the box on both the SurfaceRT and SurfaceRT2 You will need to have installed the compiler tools and libraries noted in [Cross Compiling](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled) We recommend using a small Debian or Ubuntu machine or similar for development. A Raspberry PI4 is quite a good option. `git clone https://github.com/coherixmatts/grub-2.04 cd grub-2.04 ./bootstrap ./configure --with-platform=efi --target=arm-linux-gnueabihf --enable-mm-debug --enable-boot-time` Grub should compile successfully and you should see something similar to the results below: `******************************************************* GRUB2 will be compiled with following components: Platform: arm-efi With devmapper support: Yes With memory debugging: Yes With disk cache statistics: No With boot time statistics: Yes efiemu runtime: No (not available on efi) grub-mkfont: Yes grub-mount: Yes starfield theme: Yes With DejaVuSans font from /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf With libzfs support: No (need zfs library) Build-time grub-mkfont: Yes With unifont from /usr/share/fonts/X11/misc/unifont.pcf.gz With liblzma from -llzma (support for XZ-compressed mips images) *******************************************************` We now need to compile grub as below: `make cd grub-core ../grub-mkimage -O arm-efi -d . -o grub.efi -p / part_gpt part_msdos ntfs ntfscomp hfsplus fat ext2 normal chain boot configfile linux gfxterm videoinfo efi_gop all_video video video_fb loadenv help reboot raid6rec raid5rec mdraid1x mdraid09 lvm diskfilter zfsinfo zfscrypt gcry_rijndael gcry_sha1 zfs true test sleep search search_fs_uuid search_fs_file search_label png password_pbkdf2 gcry_sha512 pbkdf2 part_apple minicmd memdisk lsacpi lssal lsefisystab lsefimmap lsefi disk keystatus jpeg iso9660 halt gfxterm_background gfxmenu trig bitmap_scale video_colors bitmap font fshelp efifwsetup echo terminal gettext efinet net priority_queue datetime bufio cat btrfs gzio lzopio crypto acpi extcmd mmap` The compiled grub.efi should now be in the current directory. Rename that file to boot.efi and copy to the root of a prepared USB for testing. A pre-compiled GRUB2 that will work on SurfaceRT and SurfaceRT2 is below: file-download 732KB [boot.efi](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRc7vblqrpl4b1P0PB%2F-MJRcrYzfZ_CnJjSgM8p%2Fboot.efi?alt=media&token=0cacf66b-7d1c-4c67-ac8f-9e6595a72524) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRc7vblqrpl4b1P0PB%2F-MJRcrYzfZ_CnJjSgM8p%2Fboot.efi?alt=media&token=0cacf66b-7d1c-4c67-ac8f-9e6595a72524) [PreviousPinMuxchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/pinmux) [NextHardwarechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # 1 - μSD Card | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card#gpios) GPIOs ------------------------------------------------------------------------------------------------------------------- Power: D7 Card Detect: I5 WriteProtect: T3 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MdrZkxitMKZj-_D7e3f%252F-Mdra4nUXmghD23tIHGf%252FSD_Card_hotplug.png%3Falt%3Dmedia%26token%3D1ed3d67e-edb0-470d-8406-45c967588ce8&width=768&dpr=3&quality=100&sign=dd52f793&sv=2) Hotplug GPIO in action [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card#power) Power ------------------------------------------------------------------------------------------------------------------- uSD Card is powered by PMIC LowDropout regaultor 5 (LDO5) It switches between 3.3V and 1.8V. [PreviousMMCchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc) [Next3 - WIFI SDIO: Marvell: 88W8797chevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/3-wifi-sdio-marvell-88w8797) Last updated 4 years ago Was this helpful? * [GPIOs](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card#gpios) * [Power](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card#power) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # 3 - WIFI SDIO: Marvell: 88W8797 | Open Surface RT [Previous1 - μSD Cardchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/1-msd-card) [Next4 - eMMCchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/4-emmc) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Bus 3 - HDMI DDC | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-3-hdmi-ddc#physical-access) Physical Access ------------------------------------------------------------------------------------------------------------------------------------------- Access to I2C Bus 3 can be found on the micro-HDMI connector [PreviousBus 2 - CAMschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-2) [NextBus 4 - Systemchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # LVDS Encoder | Open Surface RT Tegra 3 only supports a parallel interface or SPI LCD, DVI, an HDMI HDTV, RGB monitor or a MIPI DSI LCD. Surface RT uses a LVDS Display. Therefore an translator is needed. They used a **Integrated Device Technology V103 LVDS encoder** [https://datasheetspdf.com/pdf-file/696938/IntegratedDeviceTechnology/V103/1arrow-up-right](https://datasheetspdf.com/pdf-file/696938/IntegratedDeviceTechnology/V103/1) The converter is transparent to the SoC and does its job without any configuration. It only needs power and the PowerDown pin set to LOW [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/lvds-encoder#gpios) GPIOs ----------------------------------------------------------------------------------------------------------------- B2 - power down If we set this pin to LOW from UEFI Shell new information can't be send from the SoC to the display. In this case the image fades out. file-pdf 179KB [V103\_IntegratedDeviceTechnology.pdf](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeQ_paLOPmXLcqxWjpw%2F-MeQyC0j3vybkZqeDLkE%2FV103_IntegratedDeviceTechnology.pdf?alt=media&token=b1c13f8d-aff1-40c5-8f43-bf2dce18a3d8) PDF downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MeQ_paLOPmXLcqxWjpw%2F-MeQyC0j3vybkZqeDLkE%2FV103_IntegratedDeviceTechnology.pdf?alt=media&token=b1c13f8d-aff1-40c5-8f43-bf2dce18a3d8) [Previous0x60 - TI: TPS62361B - Processor Supplychevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/ti-tps62361) [NextDisplaychevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Not interesting (yet) | Open Surface RT These tables aren't needed yet since we deal with basic hardware stuff at the moment [PreviousMADT / APICchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt) [NextBGRTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/bgrt) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # GPIOs | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#how-to-identify-gpios-using-acpi) How to identify GPIOs using ACPI ----------------------------------------------------------------------------------------------------------------------------------------------------- ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MM_RL3ukk4dE7ey433u%252F-MM_TXCsLOd0FoI7gNn-%252Fimage.png%3Falt%3Dmedia%26token%3D7bdf87ce-bf01-4e1f-b875-e96e5003bbee&width=768&dpr=3&quality=100&sign=6568f2bd&sv=2) ACPI-SSDT0000.ASL - Surface RT if we take a look at the ACPI table we see several GpioIO functions. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#identifying-the-volume-keys) Identifying the Volume Keys ------------------------------------------------------------------------------------------------------------------------------------------- Identifying the Volume keys is easy. We can dump the GPIO-Controller from UEFI shell while a volume key is pressed or released. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MM_RL3ukk4dE7ey433u%252F-MM_U_13G6Go5hFyvl97%252Fimage.png%3Falt%3Dmedia%26token%3Da0a2c8d0-a267-491c-b016-59f572ce67c7&width=768&dpr=3&quality=100&sign=8c8fc1d0&sv=2) Left: Vol-Down pressed; right Vol-Down not pressed We see that we changed something with a button press. Nice! We see that 1 Byte has changed from 0xC0 to 0x80 at address 0x438 In binary: 1100 0000 -> 1000 0000 => Bit 6 has changed. Lets take a look at 0x438 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MM_RL3ukk4dE7ey433u%252F-MM_VJFPBPG2-MPtjpMK%252Fimage.png%3Falt%3Dmedia%26token%3De293e659-12fe-410d-8f00-bc2b3064db79&width=768&dpr=3&quality=100&sign=bad6709f&sv=2) 0x438 is located on the 5th GPIO Controller and is the input register. check. Now we know that we changed Pin6 in Port S => Vol-Down is connected to PS6 ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#match-it-to-acpi) Match it to ACPI S is the 19th letter of the Alphabet counting from 1 (A=1, B=2, C=3,...) S is the 18th letter of the Alphabet counting from 0 (A=0, B=1, C=2,...) [TRM](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/tegra3-technical-reference-manual) tells us that every port has 8 pins. So lets multiply 18 by 8 which equals 144 and add our PinOffset: 6 144+6 = 150 Convert 150 from dec to hex: 0x96 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MM_ZcY0OhK9nKzMW81e%252F-MM_ZxNOFpg-LLo_gjtL%252Fimage.png%3Falt%3Dmedia%26token%3Db38a2bc1-2ae9-49cf-bb1f-57d8459fc7bd&width=768&dpr=3&quality=100&sign=4d46e72e&sv=2) There is a Gpio with the number 0x96 it belongs to TEV2/MSHW0003 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MM__C9AlIe4IGp4Ux5M%252F-MM_cV29eMb5nJFqJeU9%252FHomeButtonDriver.png%3Falt%3Dmedia%26token%3Dea251d30-0680-4a94-9a37-fd17e2f03ba1&width=768&dpr=3&quality=100&sign=c003db17&sv=2) Windows device-manager screenshot We can match the 4 GPIOs to the SurfaceHomeButtonDriver. We can see that Windows knows 4 Interrupts. At the moment we dont know how to map the WindowsIRQ to ACPI-IRQ or LinuxIRQ ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#match-it-to-linux) Match it to Linux Linux enumerates GPIO in the same way as ACPI: `portNumber * 8 + pinOffset (+ gpioControllerOffset)` (gpioControllerOffset is 0 on tegra 3) We know that we deal with: `Vol-Down: 0x96 / 150d Vol-Up: 0x97 / 151d` We guess 0x97 because it is a normal shared interrupt. The other 2 interrupts are WakeUp Interrupts which should belong to the Power/WindowsButton #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#lets-use-it-the-easy-way) Lets use it the easy way include `libgpiod` in your root filesystem type gpiomon Press the button a few times you should see the gpio chaning in realtime ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MMb5iVU4_WcGJqjmPX_%252F-MMb6DF_ELZ5BTMJFSIM%252Fimage.png%3Falt%3Dmedia%26token%3D9a443cd3-d4dd-4474-8628-e3df816781a4&width=768&dpr=3&quality=100&sign=3cd1fc6b&sv=2) #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#lets-use-it-the-hard-way) Lets use it the hard way first we must set the pins to GPIO mode. Tegra standard is SFIO mode. 0x6000 d000 is the GPIO Controller base 0x0000 0408 is PortS CNF register. We want to set pin 6/7 to GPIO mode -> 0b1100 0000 -> 0xC0 we can write memory with devmem `devmem 0x6000d408 8 0xC0` Now the GPIO Controller treats PS6/7 as GPIO `cd /sys/class/gpio` `ls ./` should show `export, gpiochip0, unexport` gpiochip0 is the gpio controller; 0 tells the offset we can export a pin to userspace `echo 150 > export echo 151 > export` Now we can use PS6/7 check the direction with `cat gpio150/direction` it should show `"in"` but you can set it with `echo in > gpio150/direction` Now we can read the value `cat gpio150/value` this should return `1` if you press VOL-Down it should return `0` This tells us that the pin is pulled up and active\_low. Now remove the gpio from userspace that it can be used by drivers again `echo 150 > unexport echo 151 > unexport` [PreviousRaspberry Pi UART-Setupchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/uart/raspberry-pi-uart-setup) [Nextdecode - Pin number to Letterchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios/decode-pin-number-to-letter) Last updated 5 years ago Was this helpful? * [How to identify GPIOs using ACPI](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#how-to-identify-gpios-using-acpi) * [Identifying the Volume Keys](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#identifying-the-volume-keys) * [Match it to ACPI](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#match-it-to-acpi) * [Match it to Linux](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios#match-it-to-linux) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Memory Mapping | Open Surface RT TBD - \[someone with an RT2 needs to boot into an EFI shell and run lsefimmap\] [PreviousACPI (DSDT) Tableschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables) [NextEFI System Tableschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/efi-system-tables) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # I2C devices | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MK71R5q_CWGBonnecVy%252F-MK75TRwTC6O34wvTeet%252Fi2c-alias-to-address.png%3Falt%3Dmedia%26token%3Db577a1cf-ff21-44b5-9880-16aa798343b7&width=768&dpr=3&quality=100&sign=47e4f31&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MK71R5q_CWGBonnecVy%252F-MK74c8wYwsPMSjJWmUw%252Fi2c-addresses.png%3Falt%3Dmedia%26token%3D848a9cde-7f69-485e-82c5-b8ee39a3b45d&width=768&dpr=3&quality=100&sign=59008553&sv=2) i2c-0 i2c 7000c000.i2c I2C adapter - LVDS DDC (according to cardhu devicetree) - access on J14 i2c-1 i2c 7000c400.i2c I2C adapter - daughter board (touch controller; touch/typeCover) - access MAYBE on DaughterBoard Testpoints i2c-2 i2c 7000c500.i2c I2C adapter - nothing - dont care i2c-3 i2c 7000c700.i2c I2C adapter - HDMI DDC - Via HDMI-port i2c-4 i2c 7000d000.i2c I2C adapter - PMIC - not found :( I2C addresses on Bus - 0: 0x00; 0x28 - 1: 0x2D; 0x39; 0x5B - 2: - 3: depends on HDMI display - 4: 0x0A; 0x1A; 0x2D; 0x4A; 0x4C; 0x60 [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#hid-knowledge) HID knowledge ------------------------------------------------------------------------------------------------------------------------ ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#vendorid-prodcutid) VendorID / ProdcutID [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fwww.the-sz.com%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=ee4a3729&sv=2)USB ID Databasethe\_sz\_devchevron-right](https://www.the-sz.com/products/usbid/index.php?v=0x045E&p=&n=) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#hid-descriptor) HID Descriptor [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Flearn.microsoft.com%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=80cb8db5&sv=2)Required HID Descriptors (touchpad-required-hid-descriptors)MicrosoftLearnchevron-right](https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/windows-precision-touchpad-required-hid-descriptors#required-ic-hid-descriptor) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#device-specific-method) Device Specific Method [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Flearn.microsoft.com%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=80cb8db5&sv=2)HIDI2C Device-Specific Method (\_DSM) - Windows driversMicrosoftLearnchevron-right](https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/hidi2c-device-specific-method---dsm-) [Previous4 - eMMCchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/4-emmc) [NextBus 0 - MS HIDchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid) Last updated 4 years ago Was this helpful? * [HID knowledge](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#hid-knowledge) * [VendorID / ProdcutID](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#vendorid-prodcutid) * [HID Descriptor](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#hid-descriptor) * [Device Specific Method](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c#device-specific-method) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UEFI | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi#trustzone-and-sec-phase) TrustZone and SEC phase ------------------------------------------------------------------------------------------------------------------------- The CPU gets out of reset in Secure Mode. SEC phase kicks in, does fundamental setup and enter TrustZone. TrustZone memory occupies the lower memory (32MB). In stock firmware, TZ MVBAR address is 0x811f8000 on RT for primary core (Boot Processor.) For secondary CPUs, the MVBAR is： * Core 1 MVBAR 0x82002860 * Core 2 MVBAR 0x82003860 * Core 3 MVBAR 0x82004860 MVBAR only has valid SMC instruction entry, other exception entries are unused. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi#exploit) Exploit ----------------------------------------------------------------------------------------- There's an issue in TZ's UEFI variable handling. A working exploit can be found at [https://github.com/NekomimiRouter/yahalloarrow-up-right](https://github.com/NekomimiRouter/yahallo) . [PreviousRPMB partition on EMMCchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/rpmb-partition-on-emmc) [NextACPI Tableschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables) Last updated 5 years ago Was this helpful? * [TrustZone and SEC phase](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi#trustzone-and-sec-phase) * [Exploit](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi#exploit) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # DSDT | Open Surface RT Ours are compiled with the Microsoft compiler. RT location: Address : 0xFD8E0000 Length : 9361 (NCIDIA AP30EDK2) You can compare an DSDT table to a dtsi devicetree file. [PreviousACPI Tableschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables) [NextSSDTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # EFI System Tables | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/efi-system-tables#surface-rt2-lsefisystab-efi-system-tables) Surface RT2 lsefisystab (efi system tables) -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MJRZC-NITfKkzjC04Ic%252F-MJRZLdc38K1fZf3vuES%252Fimage.png%3Falt%3Dmedia%26token%3Dae1b6a8a-473a-440b-9817-c4a4691fe600&width=768&dpr=3&quality=100&sign=ef26b252&sv=2) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/efi-system-tables#undefined) --------------------------------------------------------------------------------------------------------- [PreviousMemory Mappingchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/memory-mapping) [NextBCT Tablechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/bct-table) Last updated 5 years ago Was this helpful? * [Surface RT2 lsefisystab (efi system tables)](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/efi-system-tables#surface-rt2-lsefisystab-efi-system-tables) * [](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/efi-system-tables#undefined) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Battery | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZUd7iPKTKj_QfttXH%252FPXL_20210726_230716752.jpg%3Falt%3Dmedia%26token%3D373ce78f-740f-4e94-8c86-83d13c717fe2&width=768&dpr=3&quality=100&sign=c769b96&sv=2) [PreviousDisplaychevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/display) [NextLenovo Ideapad Yoga 11chevron-right](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Display | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZWHRVLYFOG9DjVGYd%252F-MfZWVaol4djzz07LtmO%252FPXL_20210726_225503953.jpg%3Falt%3Dmedia%26token%3D8e9e82bc-a931-4268-ac40-09dc4cbbdf00&width=768&dpr=3&quality=100&sign=3cde9ead&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZWHRVLYFOG9DjVGYd%252F-MfZWPvCWMt429i4S3Fg%252FPXL_20210726_225434951.jpg%3Falt%3Dmedia%26token%3D09b2656a-1d7b-495f-b45f-cb38d0791262&width=768&dpr=3&quality=100&sign=3bdddd43&sv=2) [PreviousIC'schevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/ics) [NextBatterychevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/battery) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Battery | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc4AC-pl_CpQ18wRqBI%252F-Mc4BKGtS16DdM12TRPE%252FPXL_20210612_224811310.jpg%3Falt%3Dmedia%26token%3D432336a7-3526-435b-b020-aa6ba90a7734&width=768&dpr=3&quality=100&sign=6a33b7c3&sv=2) Surface RT battery pack with exposed BMS circuit triangle-exclamation #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#batteries-are-dangerous-working-on-one-is-difficult-and-require-patience-and-skills-do-not-disassemb) Batteries are dangerous, working on one is difficult and require patience and skills! Do not disassemble, peel or remove one from the device unless you know what you're doing! [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#specifications-of-the-battery-pack) Specifications of the battery pack ----------------------------------------------------------------------------------------------------------------------------------------------------------- Specifications Title Manufacturer Samsung Capacity 31.5Wh Voltage 7.4V Model number P21GK3 [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#bms-battery-management-system) BMS (Battery Management System) --------------------------------------------------------------------------------------------------------------------------------------------------- A battery pack requires a reliable BMS. Without it you can't control and balance the cells, leading to fire hazards. Overview BMS Cable ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-McAdxsHNKXengcC3Daf%252F-McAfi-Cu0_9iTOp0bS7%252FBMS_OVERVIEW.png%3Falt%3Dmedia%26token%3Db3a3d201-afd3-41dd-bcbb-51f6114d1478&width=768&dpr=3&quality=100&sign=544c9d57&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc8ryGXALCTkUk33b74%252F-Mc8yNGps0TgpyEQkToL%252Fbms.png%3Falt%3Dmedia%26token%3D858c07a5-0b7d-4513-8167-4f8f72e8282c&width=768&dpr=3&quality=100&sign=b0037eb8&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-McAdxsHNKXengcC3Daf%252F-McAilhgoi0oNaAhcI3B%252FBattery_Cable.png%3Falt%3Dmedia%26token%3Df0b847fe-902a-423d-803c-0c7772cbdd5f&width=768&dpr=3&quality=100&sign=b8eb4659&sv=2) #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#ics-marked-with-1-3) IC's marked with 1-3: 1. [https://www.dexerials.jp/en/products/surface-mounted-type-fuse/sfh0412.htmlarrow-up-right](https://www.dexerials.jp/en/products/surface-mounted-type-fuse/sfh0412.html) 2. ??? 3. [https://www.ti.com/product/BQ28400#product-details##paramsarrow-up-right](https://www.ti.com/product/BQ28400#product-details##params) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#high-resolution-mock-up-of-bms-board) High resolution mock-up of BMS board --------------------------------------------------------------------------------------------------------------------------------------------------------------- BMS board part 1 BMS board part 2 BMS board part 3 BMS board part 4 Cable ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc3zQtaJzzGLi1qtgm0%252F-Mc41OWgt-q9fIjxSZBN%252Fbattery-bms1.png%3Falt%3Dmedia%26token%3D3726e3b9-88a6-491a-be6e-bd08a52b560c&width=768&dpr=3&quality=100&sign=58eeedd9&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc3zQtaJzzGLi1qtgm0%252F-Mc41OWhLgsc5fSVbHvi%252Fbattery-bms2.png%3Falt%3Dmedia%26token%3D16649838-0887-433a-bee6-4276a0378cdc&width=768&dpr=3&quality=100&sign=8c8415d4&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc3zQtaJzzGLi1qtgm0%252F-Mc41OWiGcVj5fbkh1nz%252Fbattery-bms3.png%3Falt%3Dmedia%26token%3D1194f5a2-486e-4863-92e4-26b1a8e75d7c&width=768&dpr=3&quality=100&sign=89f11196&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc3zQtaJzzGLi1qtgm0%252F-Mc41OWcrEbz2d22lQSt%252Fbattery-bms4.png%3Falt%3Dmedia%26token%3D5f494e80-72d6-4a48-8ad0-e7d91e04e6e6&width=768&dpr=3&quality=100&sign=7bc2be64&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-McAdxsHNKXengcC3Daf%252F-McAipRwmeUDfF5ZE2dE%252FBattery_Cable.png%3Falt%3Dmedia%26token%3Df7985e38-90a5-46e4-97ac-5da2fa6bed3c&width=768&dpr=3&quality=100&sign=98b16695&sv=2) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#macro-shots-of-the-various-ics) Macro shots of the various IC's ---------------------------------------------------------------------------------------------------------------------------------------------------- Chip 1 Chips 2 Chip 3 Chip 4 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc47OKbE9hdJOBfGn1S%252F-Mc49GKYUAkOvO3taTf-%252FPXL_20210613_142937978.jpg%3Falt%3Dmedia%26token%3Da7360da2-fd7b-4a25-bae6-1239faaf7931&width=768&dpr=3&quality=100&sign=21e5a58d&sv=2) 10 Amperes SFH Series Self Control Protector(SCP) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc47OKbE9hdJOBfGn1S%252F-Mc49GKU-Ynz9T4_bZre%252FPXL_20210613_142735502.jpg%3Falt%3Dmedia%26token%3D5b1becbe-626c-45cb-bd04-0c54604985f0&width=768&dpr=3&quality=100&sign=6749640f&sv=2) ??? - Guessing both are balance chips ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc47OKbE9hdJOBfGn1S%252F-Mc49GK_-uAUE0A0HDmI%252FPXL_20210613_142719270.jpg%3Falt%3Dmedia%26token%3D62f083f8-fd21-411a-ade5-7404f94548ec&width=768&dpr=3&quality=100&sign=d6382003&sv=2) BQ28400 Netbook and Tablet Lithium ion gas gauge and protector ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-Mc47OKbE9hdJOBfGn1S%252F-Mc49GKZWE03FI6o-atc%252FPXL_20210613_142658484.jpg%3Falt%3Dmedia%26token%3Dddc120dc-bcf3-451e-99c5-133818211e52&width=768&dpr=3&quality=100&sign=cb2cde16&sv=2) ??? - Chip is unmarked, suspecting it's a temp probe logic [PreviousDisplaychevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display) [NextFirmwarechevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware) Last updated 4 years ago Was this helpful? * [Specifications of the battery pack](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#specifications-of-the-battery-pack) * [BMS (Battery Management System)](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#bms-battery-management-system) * [High resolution mock-up of BMS board](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#high-resolution-mock-up-of-bms-board) * [Macro shots of the various IC's](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery#macro-shots-of-the-various-ics) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # BCT Table | Open Surface RT BCT Table for SurfaceRT2 \[To be dumped still\] [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/bct-table#reference) Reference: ------------------------------------------------------------------------------------------------------------- See notes at [https://github.com/NVIDIA/cbootimage-configsarrow-up-right](https://github.com/NVIDIA/cbootimage-configs) [PreviousEFI System Tableschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/efi-system-tables) [NextIC'schevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/ics) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # ACPI (DSDT) Tables | Open Surface RT ACPI Dump for RT2. file-download 1MB [acpiview\_dump\_rt2\_20200805.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRQyNlBtJlxv9Rep4g%2F-MJRRY7eDwVcoaNwBzNW%2Facpiview_dump_rt2_20200805.txt?alt=media&token=0a7a52df-169d-445e-8604-79902c15faa4) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRQyNlBtJlxv9Rep4g%2F-MJRRY7eDwVcoaNwBzNW%2Facpiview_dump_rt2_20200805.txt?alt=media&token=0a7a52df-169d-445e-8604-79902c15faa4) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables#what-is-a-dsdt) What is a DSDT ----------------------------------------------------------------------------------------------------------------------------- DSDT (Differentiated System Description Table) is a part of the [ACPIarrow-up-right](https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface) specification. It supplies information about supported power events in a given system. ACPI tables are provided in firmware from the manufacturer. Ours are compiled with the Microsoft compiler. RT2 location: Address : 0xFDEFD000 Length : 15469 (NVIDIA T114EDK2) Further reading: [https://wiki.archlinux.org/index.php/DSDT#Recompiling\_it\_yourselfarrow-up-right](https://wiki.archlinux.org/index.php/DSDT#Recompiling_it_yourself) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables#rt2-dsdt-source) RT2 DSDT Source ------------------------------------------------------------------------------------------------------------------------------- file-download 135KB [SurfaceRT2.dsdt.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRQyNlBtJlxv9Rep4g%2F-MJRWGL-qUYSsacSaiqF%2FSurfaceRT2.dsdt.txt?alt=media&token=45e38d2c-0dc8-4080-925e-3e97e291d27a) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MJRQyNlBtJlxv9Rep4g%2F-MJRWGL-qUYSsacSaiqF%2FSurfaceRT2.dsdt.txt?alt=media&token=45e38d2c-0dc8-4080-925e-3e97e291d27a) [PreviousSpecificationschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/specifications) [NextMemory Mappingchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/memory-mapping) Last updated 5 years ago Was this helpful? * [What is a DSDT](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables#what-is-a-dsdt) * [RT2 DSDT Source](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables#rt2-dsdt-source) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Hardware | Open Surface RT The Surface 2 was launched in 2013, being a follow-up to Surface RT with spec bump and improvements. Featuring faster internals and higher resolution panel with better colour reproduction. [https://support.microsoft.com/en-gb/surface/surface-2-specifications-7a5aaf4f-9641-2c69-3747-ea4e2a161aaearrow-up-right](https://support.microsoft.com/en-gb/surface/surface-2-specifications-7a5aaf4f-9641-2c69-3747-ea4e2a161aae) Release Date October 2013 Display Screen: 10.6" 1920x1080 16:9 Display - LTL106HL02-001 (1920x1080) DSI Backlight: **\- TO BE UPDATED -** Screen Input Voltage: **\- TO BE UPDATED -** SoC Nvidia Tegra 4 T114 CPU Quad core Cortex-A15 @ 1.71 GHz Core architecture ARMv7 32-bit RAM SK Hynix H5TC4G63AFR-PBR 2 GB DDR3 SDRAM Clocked at 1600MHz in dual channel operation Storage \- SK Hynix H26M64003DQRNAND Flash \- 64GB or 32GB capacity Camera 3.5 Megapixel front camera 5.0 Megapixel rear camera Operating System Windows RT 8.1 Battery GB-S20-3096AS-0100 7.6V 3988mAh min/4118mAh typ (31.3Wh) SIM slot Optional, micro SIM **Only AT&T models with LTE/4G modem** [PreviousCompiling GRUB2chevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/compiling-grub2) [NextSpecificationschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/specifications) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # IC's | Open Surface RT ??? ?? SoC EMMC wireless SDRAM ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZVIfVHI4UnKkWNFKf%252FPXL_20210726_225229562.jpg%3Falt%3Dmedia%26token%3Db7a93b6f-ccdc-4b7f-8618-1302e2bf96cf&width=768&dpr=3&quality=100&sign=9ba11142&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZVIfWx3N8q1ZT08hB%252FPXL_20210726_225259112.jpg%3Falt%3Dmedia%26token%3Dab77f4f6-bb6d-4f11-ad5f-9368cfc16c2e&width=768&dpr=3&quality=100&sign=4d77a3ec&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZVIfQR1mxVqwkbmef%252FPXL_20210726_225009015.jpg%3Falt%3Dmedia%26token%3D2db209d2-0e99-44fc-9c4c-8facad0c5ffe&width=768&dpr=3&quality=100&sign=cb99371d&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZVIfXKNesUIKrfNXd%252FPXL_20210726_224953124.jpg%3Falt%3Dmedia%26token%3D1bf141fd-1488-410b-96e8-95035431722c&width=768&dpr=3&quality=100&sign=c6676506&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZVIfUI65ce3ZkeeMP%252FPXL_20210726_225201029.jpg%3Falt%3Dmedia%26token%3D5e26f896-200b-437c-a273-d89eaaafdbe5&width=768&dpr=3&quality=100&sign=25789d64&sv=2) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MfZSnBGk-9dpnQ8SJ6v%252F-MfZVIfTQAClwy3MR-ws%252FPXL_20210726_225023551.jpg%3Falt%3Dmedia%26token%3Ddb1f369b-3c81-440e-b28f-fb68df297d48&width=768&dpr=3&quality=100&sign=f9e16f0f&sv=2) [PreviousBCT Tablechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/bct-table) [NextDisplaychevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/display) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # IC's | Open Surface RT IC Datasheet(s) [Wolfson 8962E low power audio codec](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/wolfson-wm8962-audiocodec) [http://www.farnell.com/datasheets/1812050.pdfarrow-up-right](http://www.farnell.com/datasheets/1812050.pdf) Cypress Semiconductor CY8C20466A [https://www.infinite-electronic.cz/datasheet/d6-CY8C20466A-24LQXIT.pdfarrow-up-right](https://www.infinite-electronic.cz/datasheet/d6-CY8C20466A-24LQXIT.pdf) [https://www.cypress.com/part/cy8c20466a-24lqxitarrow-up-right](https://www.cypress.com/part/cy8c20466a-24lqxit) TI MSP430G2402 Microcontroller [https://www.ti.com/product/MSP430G2402arrow-up-right](https://www.ti.com/product/MSP430G2402) [Marvell 88W8797-BMP2 Wifi](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc/3-wifi-sdio-marvell-88w8797) [https://dtsheet.com/doc/1285471/marvell-avastar-88w8797-integrated-2x2-wlan-bluetooth-fmarrow-up-right](https://dtsheet.com/doc/1285471/marvell-avastar-88w8797-integrated-2x2-wlan-bluetooth-fm) [https://www.datasheets360.com/pdf/5802983509201174538arrow-up-right](https://www.datasheets360.com/pdf/5802983509201174538) [Integrated Device Technology V103](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/lvds-encoder) [https://datasheetspdf.com/pdf-file/696938/IntegratedDeviceTechnology/V103/1arrow-up-right](https://datasheetspdf.com/pdf-file/696938/IntegratedDeviceTechnology/V103/1) [https://www.renesas.com/eu/en/document/dst/v103arrow-up-right](https://www.renesas.com/eu/en/document/dst/v103) [Texas Instruments TPS659110](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/tps659110-pmic) [https://www.ti.com/lit/ds/symlink/tps65911.pdfarrow-up-right](https://www.ti.com/lit/ds/symlink/tps65911.pdf) [ATMEL: mXT1386E - TouchController](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard/mxt1386e-touchcontroller) [http://ww1.microchip.com/downloads/en/DeviceDoc/mXT1386E\_2v4\_Datasheet\_BX.pdfarrow-up-right](http://ww1.microchip.com/downloads/en/DeviceDoc/mXT1386E_2v4_Datasheet_BX.pdf) 3x [Atmel MXT154E touchscreen controller](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard/mxt1386e-touchcontroller) belongs to "ATMEL: mXT1386E - TouchController" Atmel UC3L microprocessor [Winbond W25Q32BV](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi) [https://www.winbond.com/resource-files/w25q32bv\_revi\_100413\_wo\_automotive.pdfarrow-up-right](https://www.winbond.com/resource-files/w25q32bv_revi_100413_wo_automotive.pdf) [PreviousGPIOs in Linuxchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios/gpios-in-linux) [NextSPI Flashchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Bus 0 - MS HID | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid#devices) Devices ------------------------------------------------------------------------------------------------------------------------- i2cdetect -y -a -r 0 Copy 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: 00 -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- 28 -- -- -- -- -- -- -- 30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid#physical-access) Physical Access ----------------------------------------------------------------------------------------------------------------------------------------- Access to I2C Bus 0 can be found on [J14](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/j14-oem-debug-connector#j14-schematic) . [https://en.wikipedia.org/wiki/Extended\_Display\_Identification\_Dataarrow-up-right](https://en.wikipedia.org/wiki/Extended_Display_Identification_Data) [PreviousI2C deviceschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c) [Next0x00 - Microsoft: Type/Touch Coverchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid/microsoft-type-touch-cover) Last updated 4 years ago Was this helpful? * [Devices](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid#devices) * [Physical Access](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid#physical-access) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Display | Open Surface RT file-pdf 1MB [LTL106AL01-002\_Rev.P00\_20140514\_201506075567.pdf](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MObzfLiCSFCan1DeaBx%2F-MObzmYt4kQeJOqDbNlq%2FLTL106AL01-002_Rev.P00_20140514_201506075567.pdf?alt=media&token=b829198b-101a-4006-8278-88e4772b1ac2) PDF downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MObzfLiCSFCan1DeaBx%2F-MObzmYt4kQeJOqDbNlq%2FLTL106AL01-002_Rev.P00_20140514_201506075567.pdf?alt=media&token=b829198b-101a-4006-8278-88e4772b1ac2) [https://www.panelook.com/LTL106AL01-002\_Samsung\_10.6\_LCM\_overview\_19126.htmlarrow-up-right](https://www.panelook.com/LTL106AL01-002_Samsung_10.6_LCM_overview_19126.html) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#timing) Timing --------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#raw-edid-from-acpi) Raw EDID from ACPI Copy 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x4c, 0xa3, 0x42, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x01, 0x04, 0xa0, 0x17, 0x0d, 0x78, 0x0a, 0x87, 0xf5, 0x94, 0x57, 0x4f, 0x8c, 0x27, 0x27, 0x50, 0x54, 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x1e, 0x1c, 0x56, 0xb0, 0x50, 0x00, 0x0a, 0x30, 0x0e, 0x38, 0x13, 0x00, 0xeb, 0x84, 0x00, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0xdc, 0x03, 0x74, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x53, 0x41, 0x4d, 0x53, 0x55, 0x4e, 0x47, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x31, 0x30, 0x36, 0x41, 0x4c, 0x30, 0x31, 0x2d, 0x30, 0x30, 0x31, 0x0a, 0x20, 0x00, 0x7e file-download 128B [edid\_sRT.bin](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSCAaGDdPFlP7HmD4mf%2F-MSCOvl_jnRXZNhZv_ls%2Fedid_sRT.bin?alt=media&token=cc7ff2ce-46a4-408c-b4f0-b7781c4e0dd2) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSCAaGDdPFlP7HmD4mf%2F-MSCOvl_jnRXZNhZv_ls%2Fedid_sRT.bin?alt=media&token=cc7ff2ce-46a4-408c-b4f0-b7781c4e0dd2) Binary version of EDID ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#decoded-edid) Decoded EDID Many tools exist which can decode EDID. On Ubuntu you can use `edid-decode`. The ouput is below... file-download 1KB [edid\_sRT.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSCAaGDdPFlP7HmD4mf%2F-MSCP9_mHqhafH2HjIvc%2Fedid_sRT.txt?alt=media&token=47a87212-2e9c-4c43-ba47-efe6d430d46b) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSCAaGDdPFlP7HmD4mf%2F-MSCP9_mHqhafH2HjIvc%2Fedid_sRT.txt?alt=media&token=47a87212-2e9c-4c43-ba47-efe6d430d46b) Human Readable version of EDID You can also use this [EDID readerarrow-up-right](http://www.edidreader.com/) page ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#translated-to-devicetree) Translated to devicetree **WIP** At the we use a samsung display with same resolution and similar timings which works. But to optimize the devicetree someone has to decode EDID to panel-timings [https://elixir.bootlin.com/linux/latest/source/include/drm/drm\_modes.h#L201arrow-up-right](https://elixir.bootlin.com/linux/latest/source/include/drm/drm_modes.h#L201) [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)linux/Documentation/devicetree/bindings/display/panel/panel-timing.yaml at master · torvalds/linuxGitHubchevron-right](https://github.com/torvalds/linux/blob/master/Documentation/devicetree/bindings/display/panel/panel-timing.yaml) [https://glenwing.github.io/docs/VESA-DMT-1.12.pdfarrow-up-right](https://glenwing.github.io/docs/VESA-DMT-1.12.pdf) page 57 [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#gpios) GPIOs ------------------------------------------------------------------------------------------------- Controlling the following GPIOs from UEFI Shell gave the result below. The GPIOs were extracted from ACPI GPIO Backlight Logo Note Function B2 Y N Image fades out LVDS power down DD0 N Y Logo can bee seen with external light source backlight power DD2 N N Display is dead panel power H0 N Y PWM brightness control PWM brightness [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#connector) Connector --------------------------------------------------------------------------------------------------------- ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MQzx939TIx4tQaL-hcA%252F-MR0C0lNSxYLE7dkrM0H%252Fimage.png%3Falt%3Dmedia%26token%3D164a1f23-5970-44cd-b64d-024cc8319be6&width=768&dpr=3&quality=100&sign=7726969&sv=2) Pin 2/3 Panel VDD GPIO DD2 25 BL\_PWM GPIO H0 26 Backlight enable GPIO DD0 28/29/30 LED Anode Always connected to 12V [PreviousLVDS Encoderchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/lvds-encoder) [NextBatterychevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/battery) Last updated 4 years ago Was this helpful? * [Timing](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#timing) * [Raw EDID from ACPI](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#raw-edid-from-acpi) * [Decoded EDID](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#decoded-edid) * [Translated to devicetree](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#translated-to-devicetree) * [GPIOs](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#gpios) * [Connector](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/display#connector) Was this helpful? sun-brightdesktopmoon edid\_sRT.txt Copy /* cut binary dump*/ EDID version: 1.4 Manufacturer: SEC Model 12610 Serial Number 0 Made in year 2011 Digital display 8 bits per primary color channel Digital interface is not defined Maximum image size: 23 cm x 13 cm Gamma: 2.20 Supported color formats: RGB 4:4:4, YCrCb 4:4:4 First detailed timing includes the native pixel format and preferred refresh rate Color Characteristics Red: 0.5800, 0.3398 Green: 0.3095, 0.5498 Blue: 0.1552, 0.1552 White: 0.3134, 0.3291 Established Timings I & II: none Standard Timings: none Detailed mode: Clock 71.980 MHz, 235 mm x 132 mm 1366 1380 1436 1542 ( 14 56 106) 768 769 772 778 ( 1 3 6) -hsync -vsync VertFreq: 60.000 Hz, HorFreq: 46.680 kHz Manufacturer-Specified Display Descriptor (0x0f): 00 0f 00 00 00 00 00 00 00 00 00 44 dc 03 74 00 ...........D..t. Alphanumeric Data String: SAMSUNG Alphanumeric Data String: 106AL01-001 Checksum: 0x7e sun-brightdesktopmoon --- # Bus 2 - CAMs | Open Surface RT [Previous0x5B - ATMEL: mXT1386E - TouchControllerchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard/mxt1386e-touchcontroller) [NextBus 3 - HDMI DDCchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-3-hdmi-ddc) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # ACPI Tables | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#acpi-tables) ACPI Tables ------------------------------------------------------------------------------------------------------------- * APIC - Advanced Programmable Interrupt Controller * BGRT - Boot Graphics Resource Table * DBG2 - Debug Port Table 2 * CSRT - Core System Resource Table * [DSDT](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-dsdt) - Differentiated System Description Table * FACP - Fixed ACPI Description Table * FPDT - Firmware Performance Data Table * MSDM - Microsoft Data Management table * RSDP - Root System Description Pointer * [SSDT](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt) - Secondary System Description Table * TPM2 - Trusted Platform Module 2.0 * WDSA - Windows Specific Table. Contains tCover information * XSDT - Extended System Description Table Fields file-archive 17KB [ACPI-Tables-SurfaceRT.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MMUpaUCwE5vechBTueN%2F-MMUqJRjNSFxPaM6Ko9b%2FACPI-Tables-SurfaceRT.zip?alt=media&token=e90f2adb-41ec-4910-aa03-d509852ce25d) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MMUpaUCwE5vechBTueN%2F-MMUqJRjNSFxPaM6Ko9b%2FACPI-Tables-SurfaceRT.zip?alt=media&token=e90f2adb-41ec-4910-aa03-d509852ce25d) file-archive 41KB [ACPI-Tables-SurfaceRT-decompiled.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-McInxuzKn0fDNq-IZ5a%2F-McIoBPyMI_7mETBupoF%2FACPI-Tables-SurfaceRT-decompiled.zip?alt=media&token=c030d9b6-e85d-41b3-9402-e6ee214b7b29) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-McInxuzKn0fDNq-IZ5a%2F-McIoBPyMI_7mETBupoF%2FACPI-Tables-SurfaceRT-decompiled.zip?alt=media&token=c030d9b6-e85d-41b3-9402-e6ee214b7b29) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#get-acpi-tables-from-surface-rt) Get ACPI-Tables from Surface RT ----------------------------------------------------------------------------------------------------------------------------------------------------- You need to be able to [run unsigned EFI apps](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#enabling-test-signing) . get ShellBinPkg.zip from [https://github.com/tianocore/edk2/releases/tag/edk2-stable201911arrow-up-right](https://github.com/tianocore/edk2/releases/tag/edk2-stable201911) And use the startup script below. Dumped tables should be in the dump folder file-download 564B [startup.nsh](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MMUqZexabLpdRVusAiP%2F-MMUsaO4tf0pA-rcLdND%2Fstartup.nsh?alt=media&token=bb4d2580-2823-47ae-ae1d-f2c124e85d21) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MMUqZexabLpdRVusAiP%2F-MMUsaO4tf0pA-rcLdND%2Fstartup.nsh?alt=media&token=bb4d2580-2823-47ae-ae1d-f2c124e85d21) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#decompile-acpi-tables) Decompile ACPI-Tables --------------------------------------------------------------------------------------------------------------------------------- To decompile ACPI on Linux you would normally use IASL. But all Tables are compiled with the Microsoft ASL compiler. Since MS\_ASL isn't as strict as IASL, IASL detects some errors and won't decompile all tables. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#iasl) IASL ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#ms-asl) MS ASL [https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/microsoft-asl-compilerarrow-up-right](https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/microsoft-asl-compiler) file-download 155KB [microsoft\_asl.exe](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-McIopKbSNpZm4tT3j56%2F-McIp65K-iyZlVXrAP6j%2Fmicrosoft_asl.exe?alt=media&token=decba85f-7599-431b-8e4a-564bbacf26a7) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-McIopKbSNpZm4tT3j56%2F-McIp65K-iyZlVXrAP6j%2Fmicrosoft_asl.exe?alt=media&token=decba85f-7599-431b-8e4a-564bbacf26a7) You can't decompile RSDP0000.bin but it only contains 2 Pointers [PreviousUEFIchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi) [NextDSDTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-dsdt) Last updated 4 years ago Was this helpful? * [ACPI Tables](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#acpi-tables) * [Get ACPI-Tables from Surface RT](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#get-acpi-tables-from-surface-rt) * [Decompile ACPI-Tables](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#decompile-acpi-tables) * [IASL](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#iasl) * [MS ASL](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables#ms-asl) Was this helpful? sun-brightdesktopmoon Decompile with IASL Copy iasl -da APIC0000.bin BGRT0000.bin CSRT0000.bin DBG20000.bin FACP0000.bin FPDT0000.bin MSDM0000.bin TPM20000.bin XSDT0000.bin Decompile with MS\_ASL Copy wine microsoft_asl.exe /u /e DSDT0000.bin wine microsoft_asl.exe /u /e SSDT0000.bin wine microsoft_asl.exe /u /e SSDT0001.bin wine microsoft_asl.exe /u /e WDSA0000.bin sun-brightdesktopmoon --- # Software Support | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#microsoft-store) Microsoft Store -------------------------------------------------------------------------------------------------------------------- The last known version of the Store to provide somewhat normal functionality is 11706.1001.26.0. Although it is possible to install more recent versions of the Microsoft Store it will only function to install updates for apps that are manually installed or apps already purchased and available on the users account, the purchase and installation of new apps directly from recent versions of the store on this build will not work. [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#provisioned-apps) Provisioned Apps ---------------------------------------------------------------------------------------------------------------------- This build omits certain apps that were either not available for ARM (ARMv7) processors at the time or were simply excluded from the build for other reasons. Although the included apps are limited there are numerous additional apps still available as well as updates for the preinstalled apps that are compatible with this build. In its original release the following provisioned apps are included: App Version Date Alarms & Clock 2017.203.236.0 2017-02-09 Calculator 2017.131.1904.0 2017-02-09 Messaging 3.2.2001.0 2017-02-09 Microsoft Edge 40.15035.0.0 2017-02-09 Feedback Hub 1.1611.3471.0 2017-02-09 People 2017.203.2255.0 2017-02-09 Settings 6.2.0.0 2017-02-09 Tips 4.5.6.0 2017-02-09 View 3D Preview 1.1701.30049.0 2017-02-09 Voice Recorder 2017.130.1208.0 2017-02-09 Xbox 2017.113.1250.0 2017-02-09 The provisioned apps may be updated to the following versions: App Version Date Alarms & Clock 10.1705.1303.2000 2018-09-08 Calculator 10.1705.21204.0 2019-05-01 Messaging 3.37.23004.1000 2019-05-22 Microsoft Edge N/A N/A Feedback Hub 1.1712.1141.0 2018-04-26 People 10.2.2791.2000 2018-09-08 Settings N/A N/A Tips 5.12.2691.2000 2018-09-08 View 3D Preview N/A N/A Voice Recorder 10.1705.1302.2000 2018-09-08 Xbox 48.70.21001.0 2020-10-22 [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#additional-apps) Additional Apps -------------------------------------------------------------------------------------------------------------------- The following apps can be installed on this build to provide a more complete and standard experience, these apps can be installed on this build without modification however it should be noted that some are and will become inoperable as the services they rely on are retired. App Version Date App Installer 1.0.32912.0 2019-10-19 Camera 2017.727.40.2000 2018-09-08 Groove Music 10.18052.11111.0 2018-06-05 Mail and Calendar 16005.11001.20116.0 2018-11-26 Maps 5.1705.1391.2000 2018-09-08 Money 4.26.12334.0 2018-08-22 Movies & TV 10.18052.10711.0 2018-06-04 News 4.25.11802.0 2018-07-03 Lens 16.0.32001.0 2020-10-01 OneDrive 17.30.3.0 2018-07-01 OneNote 16001.11629.20028.0 2019-05-05 Photos 2017.35063.44410.1000 2018-09-07 Remote Desktop 10.1.1148 2020-01-03 Skype 12.1815.210.1000 2018-10-03 Solitaire Collection 4.4.6132.0 2019-06-14 Sports 4.25.11802.0 2018-07-03 Store 11811.1001.27.0 2019-03-26 Sway 18.2003.51105.0 2020-03-12 To-Do 1.48.21892.0 2019-07-08 Weather 4.26.12153.0 2018-08-09 Whiteboard 20.11020.5479.0 2020-11-13 Wireless Display Adapter 3.4.137.1000 2019-06-07 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MQ8nYNPBpoFlLs2Tc9D%252F-MQ8nhFk1BpkVOjItdB8%252F15035-AdditionalApps.png%3Falt%3Dmedia%26token%3D6fd81ecd-4074-497c-9e34-b642e9cc3534&width=768&dpr=3&quality=100&sign=21427d06&sv=2) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#internet-explorer-11) Internet Explorer 11 ------------------------------------------------------------------------------------------------------------------------------ Internet Explorer 11 is not installed or included in the Windows image as a Feature on Demand package by default however it is available as a separate optional package on the installation media in \\sources\\sxs which can be installed by running the command below: [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#office-2013-rt) Office 2013 RT ------------------------------------------------------------------------------------------------------------------ This build supports all versions of Office 2013 RT which were previously included with Windows RT, if installed on this build Windows Update will work to provide any available updates for Office 2013 RT. Activating this version of Office requires license modification. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MQ8nYNPBpoFlLs2Tc9D%252F-MQ8ncH2PDP3nyh7rFaQ%252F15035-Office_2013_RT.png%3Falt%3Dmedia%26token%3Dd653647b-c936-4f77-a5a4-23cbd383cbe8&width=768&dpr=3&quality=100&sign=b4bb79a8&sv=2) [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#third-party) Third Party ------------------------------------------------------------------------------------------------------------ Most software that was recompiled for jailbroken Windows RT devices will run on this build. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#external-resources) External Resources * A list of tested games can be found [herearrow-up-right](https://docs.google.com/spreadsheets/d/1qg_yTErhuO3OHPSQsej41BxAmolqVrMWw1UmxkQKoAU/edit#gid=0) ("Cobs" @ [Surface RT Dev Discordarrow-up-right](https://discord.gg/tAxvvVC) ) * A list of desktop apps ported to Windows RT can be found [here arrow-up-right](https://forum.xda-developers.com/t/desktop-apps-ported-to-windows-rt.2092348/) ([GoodDayToDie arrow-up-right](https://forum.xda-developers.com/m/gooddaytodie.3529492/) @ [XDA Developersarrow-up-right](https://forum.xda-developers.com/) ) [Windows 10 build 15035arrow-up-right](https://betawiki.net/wiki/Windows_10_build_15035) by [BetaWikiarrow-up-right](https://betawiki.net/) , used under [CC BYarrow-up-right](https://creativecommons.org/licenses/by-sa/4.0/) / Desaturated from original [PreviousWindows 10chevron-left](https://open-rt.gitbook.io/open-surfacert/common/windows-10) [NextFake Buildschevron-right](https://open-rt.gitbook.io/open-surfacert/common/windows-10/fake-builds-and-customized-releases) Last updated 2 years ago Was this helpful? * [Microsoft Store](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#microsoft-store) * [Provisioned Apps](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#provisioned-apps) * [Additional Apps](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#additional-apps) * [Internet Explorer 11](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#internet-explorer-11) * [Office 2013 RT](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#office-2013-rt) * [Third Party](https://open-rt.gitbook.io/open-surfacert/common/windows-10/software#third-party) Was this helpful? sun-brightdesktopmoon Copy DISM.exe /Online /Add-Package /PackagePath:microsoft-windows-internetexplorer-optional-package.cab sun-brightdesktopmoon --- # Linux | Open Surface RT Progress has been made on the Lenovo Ideapad Yoga 11. It is now possible to boot Linux on the device. circle-info None of the Open Surface RT members owns a device like this. Testing was done by @not\_important and @lgibson02. We have had to rely on their feedback if something works or not, or which workarounds are required for what. Thanks for the help. [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#current-hardware-support) Current hardware support ------------------------------------------------------------------------------------------------------------------------------------------------------ * Screen & HDMI * WiFi * Touchscreen * Touchpad * Keyboard (without FN functionality) * USB ports * Micro SD card [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#prebuilt-binaries) Prebuilt binaries ---------------------------------------------------------------------------------------------------------------------------------------- TODO: still need to be checked if they work. file-download 8MB [zImage](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MiIo8xACbj7VvE77jxe%2F-MiIoQ_z9apCre-AjG8z%2FzImage?alt=media&token=5262bc68-b6fb-4ff0-978c-70d1b536c39b) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MiIo8xACbj7VvE77jxe%2F-MiIoQ_z9apCre-AjG8z%2FzImage?alt=media&token=5262bc68-b6fb-4ff0-978c-70d1b536c39b) zImage file-download 55KB [tegra30-lenovo-ideapad-yoga-11.dtb](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MiIo8xACbj7VvE77jxe%2F-MiIoYFbPkpfoKa_dWXg%2Ftegra30-lenovo-ideapad-yoga-11.dtb?alt=media&token=e483fad2-9519-4d62-a91d-df2f2cf8fe84) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MiIo8xACbj7VvE77jxe%2F-MiIoYFbPkpfoKa_dWXg%2Ftegra30-lenovo-ideapad-yoga-11.dtb?alt=media&token=e483fad2-9519-4d62-a91d-df2f2cf8fe84) Device tree Modules are [herearrow-up-right](https://files.penguins.win/Linux-Kernel-Download/modules/modules_5.14.0-rc7-next-20210827-g5ade03a75ae7.zip) (our file mirror). Too big for GitBook. [zImagearrow-up-right](https://files.penguins.win/Linux-Kernel-Download/2021-Aug-29-grate_driver-LIPY11-EFISTUB-Leander-signed) and [device treearrow-up-right](https://files.penguins.win/Linux-Kernel-Download/2021-Aug-29-grate_driver-tegra30-lenovo-ideapad-yoga-11.dtb) can also be downloaded from our file mirror. [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#booting) Booting -------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#prerequisites) Prerequisites To get started, make sure test signing is enabled. Visit [Secure Boot](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#enabling-test-signing) for instructions on how to do it. circle-info You cannot apply Yahallo (Disable secure boot) on this device. It's Surface RT & Surface RT 2 only, as off August 2021. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#preparing-the-files) Preparing the files * To boot to a desktop Linux environment, you need to put a Linux Distribution onto your SD card. [RPI OS](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/root-filesystem/distros/raspberry-pi-os) is tested and works. * You also need to prepare a FAT32 formatted USB drive. Visit [FAT32 isn't FAT32](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/fat32-isnt-fat32) for possible issues and instructions when formatting. * Get the Golden Key USB setup from [here](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot#using-test-signing-to-boot-files-from-usb) , and extract the given ZIP to your USB drive. * Take the `zImage` file from [Prebuilt binaries](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#prebuilt-binaries) above, copy it to your USB drive and rename it to `boot.efi`. * Take the `tegra30-lenovo-ideapad-yoga-11.dtb` from above and copy it to your USB drive. As disabling secure boot isn't supported on this device, the Golden Key exploit needs to be used to enable booting a Linux kernel. The Linux kernel's EFI Stub has a security check built-in that would normally prevent us from loading a custom device tree. This security check has been patched. This means we require to use the Golden Key USB setup. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#preparing-files-for-wifi-installing-modules) Preparing files for WiFi / Installing modules The WiFi driver requires being a module, as the built-in version would access a configuration file on the root filesystem, before the root filesystem is available. There are many other modules which is rather unimportant. circle-info Copying the modules and the configuration file may be an issue on Windows as the root filesystem is likely ext4. Feel free to extract the ZIP onto the root filesystem and create the configuration file once Linux runs. All of these files are not required for booting. For the changes to take affect you may need to reboot. To install the modules, extract the modules ZIP file from above onto your root filesystem. The `lib` folder of the ZIP and the root filesystem should merge. To get WiFi working you need to put the already mentioned configuration file onto your root filesystem too. The file path is integrated into the filename of the code block at the top. circle-exclamation This configuration file may contain bad parameters as the values were taken from two different devices. It is just enough to get WiFi working. circle-info Additional steps may be required to get WiFi working. See the message bellow for possible steps. > @lgibson02 please test if it's working for you by placing the following file (config file above) in `/lib/firmware/brcm` You can also use connection manager with the frontend same as in the screenshot if you want: `sudo apt-get install connman` `sudo apt-get install cmst` And then just run `cmst` ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MiIgu4ODnZxpaxzyWwn%252F-MiIhM49igpgP0s-aGTN%252FLenovoIdeapadYoga11-WiFi.png%3Falt%3Dmedia%26token%3De02e13a2-edbe-49b0-bffe-3d12d9ad2abb&width=768&dpr=3&quality=100&sign=467ba190&sv=2) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#booting-linux) Booting Linux After you inserted the SD card and the USB drive into your device, boot from your USB. Use the instructions [here](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11#booting-from-usb) . If you have done everything correctly RPI OS should show up after some time (up to 60 seconds). Have fun 🙂 circle-info If you have trouble, feel free to ask for help on our discord server. [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#compilation-guide) Compilation guide ---------------------------------------------------------------------------------------------------------------------------------------- circle-info Compiling the Linux kernel requires Linux installed on your system. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#getting-the-source-code) Getting the source code We upload all of our changes to our [OpenSurfaceRT/grate-linuxarrow-up-right](https://github.com/Open-Surface-RT/grate-linux/tree/lenovo-ideapad-yoga-11) repository. Use the `lenovo-ideapad-yoga-11` branch. To download run `git clone https://github.com/Open-Surface-RT/grate-linux.git -b lenovo-ideapad-yoga-11`. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#configuring-the-build) Configuring the build We provide a defconfig for this device. Simply run `make ARCH=arm lenovo-ideapad-yoga-11_defconfig`. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#compile-the-kernel) Compile the kernel Compiling is as simple as running `make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- -j` where value is the number of CPU cores you have available. Depending on your processors speed, the build takes from a handful of minutes to 10 minutes or longer. If the build complains that `arm-linux-gnueabihf-gcc` was not found, install the compiler. For Ubuntu the install command looks like this: `gcc-arm-linux-gnueabihf`. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#output) Output The output kernel image (`zImage`) is `arch/arm/boot/zImage`. The output device tree is `arch/arm/boot/dts/tegra30-lenovo-ideapad-yoga11.dtb`. Just put the `zImage` onto your USB drive and rename it to `boot.efi`. The device tree needs to be copied over too. No need to rename it. To get your modules run `make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- -j6 INSTALL_MOD_PATH=module_out/ modules_install`. The modules are put into the module\_out/ folder with the correct directory structure. Just copy over the lib folder to your root filesystem. If you chose to compile the kernel yourself you need to use these modules. [PreviousLenovo Ideapad Yoga 11chevron-left](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11) [Next!!! PLEASE READ !!!chevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read) Last updated 4 years ago Was this helpful? * [Current hardware support](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#current-hardware-support) * [Prebuilt binaries](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#prebuilt-binaries) * [Booting](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#booting) * [Prerequisites](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#prerequisites) * [Preparing the files](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#preparing-the-files) * [Booting Linux](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#booting-linux) * [Compilation guide](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#compilation-guide) * [Getting the source code](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#getting-the-source-code) * [Configuring the build](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#configuring-the-build) * [Compile the kernel](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#compile-the-kernel) * [Output](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux#output) Was this helpful? sun-brightdesktopmoon /lib/firmware/brcm/bcm94330wlsdgb.txt Copy # bcm94330wlsdgb.txt manfid=0x2d0 prodid=0x0552 vendid=0x14e4 devid=0x4360 boardtype=0x0552 boardrev=0x11 # this design has 2.4GHz SP3T switch boardflags=0x00080200 nocrc=1 xtalfreq=37400 boardnum=22 macaddr=00:90:4c:c5:12:38 ag0=255 aa2g=1 ccode=ALL pa0b0=0x14d0 pa0b1=0xfd98 pa0b2=0xff78 rssismf2g=0xa rssismc2g=0x3 rssisav2g=0x7 maxp2ga0=0x50 # 2.4G Tx Power offsets cck2gpo=0x5555 ofdm2gpo=0x77777777 mcs2gpo0=0xBBBB mcs2gpo1=0xBBBB sromrev=3 il0macaddr=00:90:4c:c5:12:38 wl0id=0x431b cckPwrOffset=5 ofdm2gpo=0x66666666 mcs2gpo0=0x6666 mcs2gpo1=0x6666 swctrlmap_2g=0x04040404,0x02020202,0x02020404,0x10202,0x1ff swctrlmap_5g=0x00100010,0x00280020,0x00200010,0x14202,0x2f8 rfreg033=0x19 rfreg033_cck=0x1f dacrate2g=160 txalpfbyp2g=1 bphyscale=17 cckPwrIdxCorr=-15 pacalidx2g=45 pacalath2g=180 pacalidx2g1=55 muxenab=0x10 rssi_offset=10 txgaintbl=1 sun-brightdesktopmoon --- # Specifications | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/specifications#chipset-info) Chipset Info ----------------------------------------------------------------------------------------------------------------------- * 1.7GHz NVIDIA Tegra 4 SoC * SK Hynix H26M64003DQR 32GB NAND Flash * Atmel AT32UC3L0256 32-bit AVR UC3 RISC microcontroller * 324 D81 EW * Micron Technology 2GB DDR3 SDRAM (3NE77 D9GLJ QLV5) * Texas Instruments TPS65913 processor power management unit (PMU) * Texas Instruments TPS 650 * Marvell Avastar 88W8797 Integrated 2x2 WLAN/Bluetooth/FM Single-Chip SoC * Multiple RF Micro Devices ICs * Wolfson Micro WM8962BE Audio Codec * Atmel maXTouch mXT1664S capacitive touchscreen controller * Texas Instruments MSP430 ultra-low-power microcontroller * ZUF 37K CDYF * 7.6V 31.3WH Li-ion battery * 3.5-megapixel front-facing camera * 5.0-megapixel rear-facing camera [PreviousHardwarechevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware) [NextACPI (DSDT) Tableschevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Bus 1 - 2nd Board | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard#devices) Devices -------------------------------------------------------------------------------------------------------------------------------- i2cdetect -y -a -r 1 Copy 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- -- -- -- -- 2d -- -- 30: -- -- -- -- -- -- -- -- -- 39 -- -- -- -- -- -- 40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 50: -- -- -- -- -- -- -- -- -- -- -- 5b -- -- -- -- 60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard#physical-access) Physical Access ------------------------------------------------------------------------------------------------------------------------------------------------ Access to I2C Bus 0 can be found on the back of the daughterboard. Use MTP52 & MTP53 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MdrVUKzv4HBxVTV4L0o%252F-MdrYMgbQRpev8IP175K%252Fi2c1testpoint.png%3Falt%3Dmedia%26token%3Dcfa0e0d2-559a-483e-ac29-50955e55a838&width=768&dpr=3&quality=100&sign=64f90054&sv=2) [PreviousTBC - Kionix: KXTJ9 - Accelerometerchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-0-ms-hid/mircrosoft-sensor-collection/tbc-kionix-kxtj9-accelerometer) [Next0x2Dchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard/0x2d) Last updated 4 years ago Was this helpful? * [Devices](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard#devices) * [Physical Access](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-1-daughterboard#physical-access) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Bus 4 - System | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system#bus-speed) Bus speed ----------------------------------------------------------------------------------------------------------------------------- 400 kHz [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system#devices) Devices ------------------------------------------------------------------------------------------------------------------------- i2cdetect -y -a -r 4 Copy 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: -- -- -- -- -- -- -- -- -- -- 0a -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- 1a -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- -- -- -- -- 2d -- -- 30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 40: -- -- -- -- -- -- -- -- -- -- 4a -- 4c -- -- -- 50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 60: 60 -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system#physical-access) Physical Access ----------------------------------------------------------------------------------------------------------------------------------------- Access to I2C Bus 4 is not known right now. [PreviousBus 3 - HDMI DDCchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-3-hdmi-ddc) [Next0x0A - ACPI: Control Method Batterychevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system/acpi-control-method-battery) Last updated 4 years ago Was this helpful? * [Bus speed](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system#bus-speed) * [Devices](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system#devices) * [Physical Access](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/i2c/bus-4-system#physical-access) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # SPI Flash | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#flash-chip) Flash Chip ------------------------------------------------------------------------------------------------------------------ Boot loader for the RT1 is written on a _**Winbond**_ _**W25Q32VIP**_. This is a 32MBit (4K Byte) SPI flash chip that operates in Single mode and comes in an 8 pin WSON 6X5-MM package. Its contents are locked in because of the _**P**_ variation in its name that specifies the OTP (Write Once) feature in the chip. This means the contents can't be replaced. We can however replace the entire chip. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#pinout) Pinout Below is the pinout for Single mode operation of the chip. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MRePV-ronl6xc1uQI9J%252Fimage.png%3Falt%3Dmedia%26token%3Dbfc6f15b-d2be-410a-b2b4-7252718682ea&width=768&dpr=3&quality=100&sign=1a47df91&sv=2) W25Q32 WSON 6X5-MM Pin Name I/O Function 1 /CS I Chip Select Input 2 DO O Data Output 3 /WP I Write Protect Input 4 GND Ground 5 DI I Data Input 6 CLK I Serial Clock Input 7 /HOLD I Hold Input 8 VCC Power Supply (3.3V) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#naming-convention) Naming Convention ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReT2aAxuSk1soCwEcD%252Fimage.png%3Falt%3Dmedia%26token%3D41027457-fa67-4da8-b291-d1e02cef0223&width=768&dpr=3&quality=100&sign=7a27b785&sv=2) Chip Series Naming [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#replacing-the-flash) Replacing the flash ------------------------------------------------------------------------------------------------------------------------------------ **Before starting it is recommended to dump the contents of the chip as it contains unique configuration aspects for the device. Check the** [**firmware section**](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware) **on how to do this** Replacing the chip is not to be taken lightly. It requires a hot air station to remove as it is a surface mounted package with a big ground pane in the center. Beside this there are multiple components close to the chip that need to stay in place. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#removing-the-shielding) Removing the shielding Begin by the shield covering the SOC, Memory and flash chips. This will come of very easily with little force. Take your time doing this. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReZKtG112DnAxXK-XY%252FIMG_6435.jpg%3Falt%3Dmedia%26token%3D4fee4140-96c4-4626-9d63-aa8c7df0f029&width=768&dpr=3&quality=100&sign=84d8d212&sv=2) Removing the shield ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReZY01BbgIYv3nO2ld%252FIMG_6434.jpg%3Falt%3Dmedia%26token%3D68e2f543-cc9c-49bd-8ab0-b8be4f93c2da&width=768&dpr=3&quality=100&sign=15150446&sv=2) Removing the shield Once removed we have an overview over the most important components ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReZFmLPHGPwFtkQBv4%252FIMG_6440.jpg%3Falt%3Dmedia%26token%3D62be6015-7926-4eb9-bed7-d0161d962f5a&width=768&dpr=3&quality=100&sign=e5452257&sv=2) Overview ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#removing-the-chip) Removing the chip To make the flash chip better accessible, the metal that held the shield in place can be bent back slightly. To help the desoldering the back of the PCB should be pre-heated at a low temp before starting work on the front. This will help with removing the chip and its big ground pane. Then start heating the flash chip itself at a low flow to not disturb the components around it. Make sure to heat it properly as forcing the chip off will break the pads on the PCB. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReY2_Tu0kF_3IwnDsG%252Fimage.png%3Falt%3Dmedia%26token%3D7a75b37a-ea52-4602-b271-bff32d3c3b36&width=768&dpr=3&quality=100&sign=93475bc4&sv=2) Highlighted Ground Pane ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReYtVOyBBvtI8Pmcv-%252FIMG_6443.jpg%3Falt%3Dmedia%26token%3D66d3c73a-72ec-472d-af56-b6f5eb2a0a9b&width=768&dpr=3&quality=100&sign=203198ac&sv=2) Accessing the flash chip ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MReLqf3z2mhXgg2A4-8%252F-MReZ4LWHSg0GlKfk9AG%252FIMG_6445.jpg%3Falt%3Dmedia%26token%3Df5370c17-e5cb-441c-8993-888ed517af78&width=768&dpr=3&quality=100&sign=b991a354&sv=2) Chip Removed [PreviousIC'schevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components) [NextMMCchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/mmc) Last updated 5 years ago Was this helpful? * [Flash Chip](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#flash-chip) * [Pinout](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#pinout) * [Naming Convention](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#naming-convention) * [Replacing the flash](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#replacing-the-flash) * [Removing the shielding](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#removing-the-shielding) * [Removing the chip](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/components/spi#removing-the-chip) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # MADT / APIC | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#usage) Usage ------------------------------------------------------------------------------------------------------ This table is used for the ACPI Parking Protocol. It is a protocol that allows parked CPU cores to be unparked. The parked state doesn't allow the CPU cores to execute any code, they are "disabled". The document that describes the ACPI Parking Protocol is here: [Multi-processor Startup for ARM Platformsarrow-up-right](https://acpica.org/sites/acpica/files/MP%20Startup%20for%20ARM%20platforms.docx) The [grate-driver/linuxarrow-up-right](https://github.com/grate-driver/linux/blob/master/arch/arm/kernel/acpi_parking_protocol.c) GitHub repository contains a working arm32 version of the ACPI Parking Protocol (Link points to the source file). It allows the usage of SMP on the Surface RT and on other arm32 Windows RT devices. (When you boot Linux from UEFI; not used in APX mode). [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#table-contents) Table contents ------------------------------------------------------------------------------------------------------------------------ ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#processor-cores) Processor Cores The following table describes the MADT entries of the 4 CPU cores. The ACPI Parking Protocol only requires to unpark CPU1-3, as CPU0 is already in use. CPU0 CPU1 CPU2 CPU3 Subtable Type (0B = Generic Interrupt Controller) 0x0B 0x0B 0x0B 0x0B Subtable Length 0x28 0x28 0x28 0x28 Reserved 0x0 0x0 0x0 0x0 CPU Interface Number 0x0 0x1 0x2 0x3 Processor UID 0x0 0x1 0x2 0x3 Processor Enabled True (1) True (1) True (1) True (1) Performance Interrupt Trigger Mode False (0) False (0) False (0) False (0) Virtual GIC Interrupt Trigger Mode False (0) False (0) False (0) False (0) Parking Protocol Version 1.0 1.0 1.0 1.0 Performance Interrupt B0 B1 B2 B3 Parked Address 0x82001000 0x82002000 0x82003000 0x82004000 Base Address 0x0 0x0 0x0 0x0 ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#generic-interrupt-distributor) Generic Interrupt Distributor The MADT table has an entry about the Generic Interrupt Distributor. Here are the contents: Generic Interrupt Distributor Subtable Type (0C = Generic Interrupt Distributor) 0x0C Length 0x18 Reserved 0x0 Local GIC Hardware ID 0x0 Base Address 0x50041000 Interrupt Base 0x0 Version 0.0 Reserved (x2) 0x0 [PreviousWDSAchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/wdsa) [NextNot interesting (yet)chevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet) Last updated 4 years ago Was this helpful? * [Usage](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#usage) * [Table contents](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#table-contents) * [Processor Cores](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#processor-cores) * [Generic Interrupt Distributor](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt#generic-interrupt-distributor) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # RSDP | Open Surface RT [PreviousMSDMchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/msdm) [NextTMP2chevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/tmp2) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # !TODO for everyone | Open Surface RT * Small introduction to the [Bootprocess](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence) * upload ACPI tables [sRT2](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/acpi-dsdt-tables) * move [BCT table](https://open-rt.gitbook.io/open-surfacert/surface-rt2/hardware/bct-table) & [BCT table](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/apx-boot/fusee-gelee/bct-table) to boot process? * rewrite boot process * explain difference between APX and UEFI boot * Add writeup about Trustzone Takeover [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/todo-lists#asap) ASAP ------------------------------------------------------------------------------------------------------ * check ~All-in-one Secureboot tool should move to boot section~ * Write a new, better and cleaner install guide for Windows RT, 10 and Linux [Previous!!! PLEASE READ !!!chevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read) [NextCTS devNoteschevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # BGRT | Open Surface RT [PreviousNot interesting (yet)chevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet) [NextCSRTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/csrt) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # MSDM | Open Surface RT [PreviousFPDTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/fpdt) [NextRSDPchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/rsdp) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Cross Compiling | Open Surface RT SurfaceRT or RT2 is ARMv7 (ARM32 / armhf ) Cross compiling is fairly simple when using docker, but you can do it it without. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled#cross-compiler-quick-setup-platform-agnostic-mac-linux-windows) Cross compiler quick setup (platform agnostic mac/linux/windows) Linux: apt install docker Mac: brew install docker; brew cask install docker; Windows (install docker-ce from docker.com?) `docker run --rm dockcross/linux-armv7:latest > dockcross-linux-armv7-latest chmod +x dockcross-linux-armv7-latest` To use: `./dockcross-linux-armv7 bash -c make` [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled#alternate-option-linux-debian-based-amend-for-other-package-managers-as-needed) Alternate option (linux debian based - amend for other package managers as needed) ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ `#install req's for cross compiling apt install gcc-arm-linux-gnueabihf bison autoconf autopoint flex build-essential #install random libraries that grub2 seemed to need apt install liblzma5 libarchive-dev freetype2-demos libfreetype-dev fonts-dejavu grub-theme-starfield ttf-dejavu-core libdevmapper-dev libfuse-dev ttf-unifont unifont liblzma-dev #install EDK2 bits apt install acpica-tools uuid-dev nasm python-distutils #install u-boot bits apt install swig libpython3-dev` [PreviousGRUB2 Booting Noteschevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/grub2-booting-notes) [NextInteresting Repo'schevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos) Last updated 4 years ago Was this helpful? * [Cross compiler quick setup (platform agnostic mac/linux/windows)](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled#cross-compiler-quick-setup-platform-agnostic-mac-linux-windows) * [Alternate option (linux debian based - amend for other package managers as needed)](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled#alternate-option-linux-debian-based-amend-for-other-package-managers-as-needed) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # XSDT | Open Surface RT [PreviousTMP2chevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/tmp2) [NextMemory Mappingchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/memory-mapping) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # jwa4 Notes | Open Surface RT [Windows Media Builderchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/windows-media-builder) [Surface RT & 2 Jailbreak USBchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) [PreviousUboot informationchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/further-information-1) [NextWindows Media Builderchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/windows-media-builder) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Devicetree information | Open Surface RT ARM kernel maintainers decided that the best way to configure SoC hardware, would be to create a separate description of a particular SoC into something called a [device tree filearrow-up-right](http://elinux.org/Device_Tree_Usage) , in order to keep it out of the kernel. > In Linux there is a concept of "device trees", which is quite separate from the "/dev" structure & udev. It's available in PC land, although it isn't strictly necessary necessary because of the BIOS. Cursory googling suggests that the device tree is used in EFI (or UEFI?) based boot sequences, which is a kind of modern bootloading alternative to the BIOS. > A "device tree" is a data structure that is given at boot-time, probably by the 2nd stage bootloader, to the final stage kernel so that it load the right drivers (ie kernel modules) with the right parameters. It's a platform description that iis useful for describing the parameters of standard subcomponents like PCI buses, Brand X ethernet chips, etc. In > In ARM land there has never been anything like the BIOS, which was tailored to specific hardware (especially motherboards or laptops) but had quite a universal interface across plaforms.. The BIOS was thus able to help the kernel identify the hardware arrangment of the platform. Because ARM has not history of a standard firmware bootloading stage to describe hardware, as PCs have (or had) BIOS, device trees (along with kexecboot or u-boot or barebox etc) are a more essential consideration for arm. A booting ARM core doesn't even know about other cores in the same multi-core CPU. A "device tree" a document (source or compiled bytecode) that can be passed to the kernel at boot that describes the hardware layout of the entire system. > * **dts:** Source file specification of a device tree for a platform. > > * **dtb:** Compiled bytecode representing the device tree, sometimes called a Flattened Devicee Tree (FDT). > > * **dtc:** The bytecode compiler that turns dts files into dtb file > [PreviousInteresting Repo'schevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos) [NextDo gifs work?chevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/can-it) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Do gifs work? | Open Surface RT ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MkOEON3nJ9Z-zsDav76%252F-MkOFHRBauJjBclUZCdS%252Fyes.gif%3Falt%3Dmedia%26token%3D932044df-b91a-44d9-b93b-ab9602bee4ad&width=768&dpr=3&quality=100&sign=b91eae52&sv=2) [PreviousDevicetree informationchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/further-information) [NextUboot informationchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/further-information-1) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # FACP | Open Surface RT [PreviousDBG2chevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/dbg2) [NextFPDTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/fpdt) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Surface RT & 2 Jailbreak USB | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb#this-guide-has-been-temporarily-replaced-by) This guide has been temporarily replaced by: ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fapp.gitbook.com%2Fpublic%2Fimages%2Ficon-512.png&width=20&dpr=3&quality=100&sign=665f7d92&sv=2)GitBookjwa4.gitbook.iochevron-right](https://jwa4.gitbook.io/windows/tools/surface-rt-and-surface-2-jailbreak-usb) [PreviousWindows Media Builderchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/windows-media-builder) Last updated 3 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # decode - Pin number to Letter | Open Surface RT Letter number dec range start hex range start Letter 0 0 0x00 A 1 8 0x08 B 2 16 0x10 C 3 24 0x18 D 4 32 0x20 E 5 40 0x28 F 6 48 0x30 G 7 56 0x38 H 8 64 0x40 I 9 72 0x48 J 10 80 0x50 K 11 88 0x58 L 12 96 0x60 M 13 104 0x68 N 14 112 0x70 O 15 120 0x78 P 16 128 0x80 Q 17 136 0x88 R 18 144 0x90 S 19 152 0x98 T 20 160 0xA0 U 21 168 0xA8 V 22 176 0xB0 W 23 184 0xB8 X 24 192 0xC0 Y 25 200 0xC8 Z 26 208 0xD0 AA 27 216 0xD8 BB 28 224 0xE0 CC 29 232 0xE8 DD 30 240 0xF0 EE [PreviousGPIOschevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios) [NextGPIOs in Linuxchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/hardware/gpios/gpios-in-linux) Last updated 2 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UEFI Privilege Escalation Exploit Documentation | Open Surface RT [Yahallo: Free memory accesschevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access) [UEFI Privilege Escalation: Execute code in Secure modechevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode) [Removing trustzonechevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone) [Previous!TODOchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/todo-leander) [NextYahallo: Free memory accesschevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Leander devNotes | Open Surface RT [!TODOchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/todo-leander) [UEFI Privilege Escalation Exploit Documentationchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation) [EFI linux bootingchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting) [EFI Signing / Secure Bootchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-signing-secure-boot) [Previousgit for dummys \[WIP!\] (like me)chevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys) [Next!TODOchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/todo-leander) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Uboot information | Open Surface RT uBoot on the Tegra consists of 2 parts. An SPL which will run on the Bootrom and will prepare and setup the transfer from Boot CPU to Main CPU. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/further-information-1#u-boot-debug-output) U-Boot debug output ----------------------------------------------------------------------------------------------------------------------------------------------- file-download 69KB [u-boot-max-debug-output.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MRe8C98sFdY38zfFlSE%2F-MReDMeiQ76G-JRko50j%2Fu-boot-max-debug-output.txt?alt=media&token=33dd33bc-35cb-4c9c-b975-b83af68b74f3) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MRe8C98sFdY38zfFlSE%2F-MReDMeiQ76G-JRko50j%2Fu-boot-max-debug-output.txt?alt=media&token=33dd33bc-35cb-4c9c-b975-b83af68b74f3) U-Boot max debug output The file above has the following logging configuration: `CONFIG_LOG_MAX_LEVEL=9 CONFIG_SPL_LOG_MAX_LEVEL=9 CONFIG_TPL_LOG_MAX_LEVEL=9 CONFIG_LOG_DEFAULT_LEVEL=9 CONFIG_LOG_CONSOLE=y CONFIG_SPL_LOG_CONSOLE=y CONFIG_TPL_LOG_CONSOLE=y` [PreviousDo gifs work?chevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/can-it) [Nextjwa4 Noteschevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Interesting Repo's | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#nvidia-linux-files) Nvidia Linux files ----------------------------------------------------------------------------------------------------------------------------------------- [https://developer.nvidia.com/linux-tegra-rel-16arrow-up-right](https://developer.nvidia.com/linux-tegra-rel-16) Tegra3 aka Surface RT [https://developer.nvidia.com/linux-tegra-rel-17arrow-up-right](https://developer.nvidia.com/linux-tegra-rel-17) Tegra4 aka Surface RT2 [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#uboot-tegra) UBOOT Tegra --------------------------------------------------------------------------------------------------------------------------- Good for reference DTB's etc [https://github.com/OE4T/u-boot-tegraarrow-up-right](https://github.com/OE4T/u-boot-tegra) UBoot has Tegra Mainline support: [https://gitlab.denx.de/u-boot/u-bootarrow-up-right](https://gitlab.denx.de/u-boot/u-boot) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#context-switcher-for-tegra3) Context Switcher for Tegra3 ----------------------------------------------------------------------------------------------------------------------------------------------------------- The ContextSwitcher switches back from the windows Bootmgr environment back to the UEFI environment. Good for patch reference for SurfaceRT Grub2 display. Also setup for VisualC [https://github.com/imbushuo/boot-shim-tegra-3arrow-up-right](https://github.com/imbushuo/boot-shim-tegra-3) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#qemu-for-arm32) QEMU for ARM32 --------------------------------------------------------------------------------------------------------------------------------- [https://designprincipia.com/virtualize-uefi-on-arm-using-qemu/arrow-up-right](https://designprincipia.com/virtualize-uefi-on-arm-using-qemu/) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#fusee-gelee-for-t30-surface-rt) Fusee Gelee for T30 (Surface RT) ------------------------------------------------------------------------------------------------------------------------------------------------------------------- [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)GitHub - jevinskie/fusee-launcher at b6e03fd7042ba2f1c989c1d007ebee6d4b5165efGitHubchevron-right](https://github.com/jevinskie/fusee-launcher/tree/b6e03fd7042ba2f1c989c1d007ebee6d4b5165ef) [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fgithub.com%2Ffluidicon.png&width=20&dpr=3&quality=100&sign=41c77f1&sv=2)GitHub - tofurky/tegra30\_debrick: fusee-gelee payload, supporting files, and guide for debricking Tegra 3 devices (2012 Nexus 7 and Ouya)GitHubchevron-right](https://github.com/tofurky/tegra30_debrick) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#grub-bootloader) GRUB BootLoader ----------------------------------------------------------------------------------------------------------------------------------- A prepatched GRUB2 ready for SurfaceRT or SurfaceRT2. [https://github.com/coherixmatts/grub-2.04arrow-up-right](https://github.com/coherixmatts/grub-2.04) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#misc) Misc ------------------------------------------------------------------------------------------------------------- [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fpeople.kernel.org%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=8a329e4c&sv=2)How the ARM32 kernel starts — linuswlinuswchevron-right](https://people.kernel.org/linusw/how-the-arm32-kernel-starts) I'd also recommend reading Jay Carlson's excellent notes on Embedded Linux here - [https://jaycarlson.net/embedded-linux/arrow-up-right](https://jaycarlson.net/embedded-linux/#) as an overview. [PreviousCross Compilingchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled) [NextDevicetree informationchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/further-information) Last updated 4 years ago Was this helpful? * [Nvidia Linux files](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#nvidia-linux-files) * [UBOOT Tegra](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#uboot-tegra) * [Context Switcher for Tegra3](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#context-switcher-for-tegra3) * [QEMU for ARM32](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#qemu-for-arm32) * [Fusee Gelee for T30 (Surface RT)](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#fusee-gelee-for-t30-surface-rt) * [GRUB BootLoader](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#grub-bootloader) * [Misc](https://open-rt.gitbook.io/open-surfacert/development/please-read/interesting-repos#misc) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # !!! PLEASE READ !!! | Open Surface RT triangle-exclamation [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read#this-is-the-development-section.-the-stuff-you-find-below-is-barely-tested.-some-of-it-might-be-even) This is the **development section**. The stuff you find below is **barely tested**. Some of it might be even **untested**. **USE FILES/INFORMATION FROM HERE AT YOUR** _**OWN RISK**_**!!!** ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [PreviousLinuxchevron-left](https://open-rt.gitbook.io/open-surfacert/other-devices/lenovo-ideapad-yoga-11/linux) [Next!TODO for everyonechevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/todo-lists) Last updated 5 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # CTS devNotes | Open Surface RT Development notes of CrackTheSurface [Previous!TODO for everyonechevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/todo-lists) [Nextinitrdchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/initrd) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # CSRT | Open Surface RT [PreviousBGRTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/bgrt) [NextDBG2chevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/dbg2) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Windows Media Builder | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/windows-media-builder#this-guide-has-been-temporarily-replaced-by) This guide has been temporarily replaced by: ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Fapp.gitbook.com%2Fpublic%2Fimages%2Ficon-512.png&width=20&dpr=3&quality=100&sign=665f7d92&sv=2)GitBookjwa4.gitbook.iochevron-right](https://jwa4.gitbook.io/windows/tools/windows-media-builder) [Previousjwa4 Noteschevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes) [NextSurface RT & 2 Jailbreak USBchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/jwa4-notes/surface-rt-and-surface-2-jailbreak-usb) Last updated 3 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # initrd | Open Surface RT file-download 14MB [rootfs.cpio.gz](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJQb34R_xPz0ll0scbM%2Fuploads%2FSbs1sMZAbYfnvq2CI82f%2Frootfs.cpio.gz?alt=media&token=895e50ea-118e-4855-9f27-303d44810d8c) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJQb34R_xPz0ll0scbM%2Fuploads%2FSbs1sMZAbYfnvq2CI82f%2Frootfs.cpio.gz?alt=media&token=895e50ea-118e-4855-9f27-303d44810d8c) [PreviousCTS devNoteschevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes) [Next!TODOchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # EFI linux booting | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting#issues) Issues ---------------------------------------------------------------------------------------------------------------------------------- * PMIC regulators don't work. * Audio, Wireless, Cameras, Sensors .This is also true for APX boot. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting#todo) TODO ------------------------------------------------------------------------------------------------------------------------------ * Implement ACPI for arm32. This will help in development for all other devices that run Windows RT too. Why? It removes the need for a device tree and enables us to comunicate with the firmware, which will hopefully enable us to use PMIC stuff. Also we can upstream our ACPI Parking Protocol driver, which is needed for SMP. * Get Audio, Wireless, Cameras, Sensors. * Possibly more, but we don't know about it yet. [PreviousRemoving trustzonechevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone) [NextConfigs we already triedchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried) Last updated 4 years ago Was this helpful? * [Issues](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting#issues) * [TODO](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting#todo) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Kernel module | Open Surface RT Maybe we have to write a kenel module which will init the tCover IC and hand off controll to I2C-HID Driver [PrevioustCover Linux supportchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support) [NextDump Bootromchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # !TODO | Open Surface RT * try grub multiboot with linux and windows * Try to add custom certificates to UEFI and replace standard Console Out Protocol (with the help of yahallo exploit, it makes efi vars read-/writeable) * Try to use efibootmgr in linux: ~doesn't work~ try with `mount -t efivarfs /sys/firmware/efi/efivars` * add restore script for windows boot loader [here](https://open-rt.gitbook.io/open-surfacert/surface-rt/linux/booting/uefi-boot#using-uefi-shell-to-copy-the-files) . * add a new image of the Makefile in Compiling kernel. * check add ACPI parking protocol address to [APIC](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/madt) * Dump boot0/1 from windows. Should work on srt2 too. For hectorantonio. His device has interesting issues. Messages from 14/15 July 2021 * EFI linux compilation guide has manual device tree addition. Change this to a patch. * Compare performance between pre-ExitBootServices and post-ExitBootServices * Make a test.efi that passes parameters to efi stub kernel * document what's required for efifb * document progress of lenovo ideapad yoga 11 * Add new information about Golden keys. The certificate is stored in the RPMB. [https://discord.com/channels/710026735294349322/710026735730556969/879729337375531051arrow-up-right](https://discord.com/channels/710026735294349322/710026735730556969/879729337375531051) and [https://discord.com/channels/710026735294349322/723258047878791229/879693368697966602arrow-up-right](https://discord.com/channels/710026735294349322/723258047878791229/879693368697966602) are points where this is discussed. * tell about display in uefi shell [PreviousLeander devNoteschevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes) [NextUEFI Privilege Escalation Exploit Documentationchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Surface 2 | Open Surface RT * Fix USB * Fix SD card * Audio input * verify display driver * APX * battery charger [PreviousSurface RTchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt) [Nextbatterychevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/battery) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Yahallo: Free memory access | Open Surface RT _**Disclaimer**_ _Most information only applies to SurfaceRT, but some yahallo information applies to Surface RT 2 too._ [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#the-exploit) The exploit ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#background-story) Background story Because NVIDIA/Microsoft didn't implement a check for maximum buffer size when using a SMC instruction to register a new shared buffer, it is possible to create a buffer overflow, which is then used to overwrite the area where a BootServices->SetMem UEFI call writes its memory. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#understand-the-formular) Understand the formular // Register a new shared memory buffer at 0x4000\_0000 (IRAM) with size // 0x6001\_e0e0. The following algorithm is used to determine the end address // that the QueryVariable call will write over: // response\_area = (request\_area + (area\_slice >> 1)); Ret = ArmCallSmcHelper(0x03, 0x06, 0x40000000, 0x6001e0e0); This is from the [yahallo source codearrow-up-right](https://github.com/NekomimiRouter/yahallo/blob/main/TegraSecureBootUnlock/Smc.c#L31-L54) . It gives a brief overview about the parameters, but here is more detail about them: First, you need to know which values are used from the SMC in the calculation, we don't care about parameters 1 and 2. Parameter 3 is request\_area, so in yahallo source 0x40000000. Parameter 4 is area\_slice, so in yahallo source 0x6001e0e0. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#calculation-of-the-addresses) Calculation of the addresses The calculation has the following formular: `response_area = (request_area + (area_slice >> 1))` Examples: `0x7000_f070 = (0x4000_0000 + (0x6001_e0e0 >> 1) 0x7000_f010 = (0x4000_0000 + (0x6001_e020 >> 1))` [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#use-the-exploit-to-disable-the-smmu) Use the exploit to disable the SMMU ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#tegra-3-soc-important-information) Tegra 3 SOC: Important information The Tegra 3 Technical Reference Manual (TRM) has important information about virtual addressing and configuration registers in section 18. You can download it [herearrow-up-right](https://developer.nvidia.com/embedded/dlc/T3-TRM) , but downloading requires a NVIDIA developer account. The SMMU (System Memory Managment Unit) is part of the SOC, and not part of the Cortex-A9 cores. The CPU cores have a MMU too, you can simply disable it with a `ArmDisableMmu()` call in the edk2 source tree. Yahallo reconfigures the SMMU, so all SMMU memory protection is gone. The CPU MMU still protects this memory, but you can easily disable it. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#disable-smmu) Disable SMMU To disable the SMMU, you need to write 0's to the SMMU Enable Register (0x7000f010). This can only be done when you are in secure mode, so it doesn't work if you just disable the CPU MMU. With the help of the Yahallo exploit we can write to all memory locations in secure mode, because the BootServices->SetMem call executes in secure mode. (UEFI firmware operates in secure mode generally) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#what-yahallo-does) What Yahallo does Yahallo writes 32 bytes of 0's to 0x7000f070, so it writes the Secure Region Configuration Base register, Secure Region Configuration Bound register and the Protected Region Configuration Bound register. This makes the Trustzone 0MB in size (SMMU side), so you have access to non-trustzone-secured\* memory, when CPU doesn't restrict memory access. The CPU restrictions can be removed by disabling the MMU. \* Some registers are restricted to be only accessible from Trustzone-secured CPU memory access. (e.g. from the SMMU\_ENABLE register from TRM: This register can only be accessed by Trustzone-Secured accesses from the CPU.) [PreviousUEFI Privilege Escalation Exploit Documentationchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation) [NextUEFI Privilege Escalation: Execute code in Secure modechevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode) Last updated 4 years ago Was this helpful? * [The exploit](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#the-exploit) * [Background story](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#background-story) * [Understand the formular](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#understand-the-formular) * [Use the exploit to disable the SMMU](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#use-the-exploit-to-disable-the-smmu) * [Tegra 3 SOC: Important information](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#tegra-3-soc-important-information) * [Disable SMMU](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#disable-smmu) * [What Yahallo does](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access#what-yahallo-does) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # git for dummys [WIP!] (like me) | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#clone-the-repo-with-ssh) Clone the repo with SSH ------------------------------------------------------------------------------------------------------------------------------------------------------------- Copy git clone git@github.com:Open-Surface-RT/grate-linux.git [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#add-upstream) Add upstream --------------------------------------------------------------------------------------------------------------------------------------- Copy git remote add upstream https://github.com/grate-driver/linux.git [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#update-to-upstream) update to upstream --------------------------------------------------------------------------------------------------------------------------------------------------- Copy git fetch upstream --depth=1 [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#edit-local-commits) edit local commits --------------------------------------------------------------------------------------------------------------------------------------------------- Copy git rebase -i HEAD~n [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#solve-merge-conflicts) solve merge conflicts --------------------------------------------------------------------------------------------------------------------------------------------------------- [https://phoenixnap.com/kb/how-to-resolve-merge-conflicts-in-gitarrow-up-right](https://phoenixnap.com/kb/how-to-resolve-merge-conflicts-in-git) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#log-stat) log stat ------------------------------------------------------------------------------------------------------------------------------- git log --stat [PreviousDump Bootromchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom) [NextLeander devNoteschevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes) Last updated 4 years ago Was this helpful? * [Clone the repo with SSH](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#clone-the-repo-with-ssh) * [Add upstream](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#add-upstream) * [update to upstream](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#update-to-upstream) * [edit local commits](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#edit-local-commits) * [solve merge conflicts](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#solve-merge-conflicts) * [log stat](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys#log-stat) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # SSDT | Open Surface RT Surface RT has 2 SSDT tables. SSDT0000.bin contains the hardware description (very interesting) SSDT0001.bin contains only TPM stuff. (uninteresting at the moment) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#decompile-ssdt0000.bin) Decompile SSDT0000.bin --------------------------------------------------------------------------------------------------------------------------------------------- Most of the ACPI tables can be decompiled by iASL (Intel ASL compiler). But SSDT0000.bin can **not** be decompiled by iASL. We have to use MS-ASL compiler. (MS ASL is not as strict as iASL which leads to issues with Linux) [https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/microsoft-asl-compilerarrow-up-right](https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/microsoft-asl-compiler) use `asl.exe /u /e /ResDecode SSDT0000.bin` Decompiled output below: file-download 216KB [SSDT0000.ASL](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MMUulSwsBZJeSdiVLkl%2F-MMUxhJi3sfKjLttf7nN%2FSSDT0000.ASL?alt=media&token=87f2aad3-d92a-40e0-a6c7-ed020913c6ab) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MMUulSwsBZJeSdiVLkl%2F-MMUxhJi3sfKjLttf7nN%2FSSDT0000.ASL?alt=media&token=87f2aad3-d92a-40e0-a6c7-ed020913c6ab) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#compile-ssdt0000.asl) Compile SSDT0000.ASL ----------------------------------------------------------------------------------------------------------------------------------------- There is a way to compile the SSDT0000.ASL with iasl, without getting a lot of errors about external symbols. Just put the file next to the other acpi tables (don't decompile them), and it shouldn't give errors about missing external symbols. There are 4 syntax errors, currently there are no fixes available. [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#what-ssdt0000.asl-can-tell-you) What SSDT0000.ASL can tell you ------------------------------------------------------------------------------------------------------------------------------------------------------------- WorkInProgress ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c-devices) I2C Devices Search for `I2CSerialBus` should reveal all i2c devices. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c1-hid-stuff) I2C1 (HID Stuff) 1. I2C1 0x00 - tCover 2. I2C1 0x28 - SEN1 / SNMU 3. I2C1 0x50 - GFXC?? #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c2-daughterboard) I2C2 - Daughterboard 1. I2C2 0x0C - SARA 2. I2C2 0x2D - TEV2 - cypress 3. I2C2 0x39 - TIC2 4. I2C2 0x5B - TOUA -atmel #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c3) I2C3 1. I2C3 0x10 - GFXC 2. I2C3 0x72 - GFXC #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c4-hdmi) I2C4 - HDMI 1. I2C4 0x30 - GFXC - EDID 2. I2C4 0x3A - GFXC - EDID 3. I2C4 0x3B - GFXC - EDID 4. I2C4 0x50 - GFXC - EDID #### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c5-mainboard) I2C5 -Mainboard 1. I2C5 0x0A - TRO1 - battery? 2. I2C5 0x0C - SARA / TIC1 3. I2C5 0x1A - AUDI - wolfson 4. I2C5 0x2D - Power resource / PMUD / TR3\_(RTC) - PMIC 5. I2C5 0x4C - THEM / TI2C 6. I2C5 0x60 - PMUD - PMIC2 ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#gpios) GPIOs ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#interrupts) Interrupts ### [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#power-resources) Power Resources * PRS1 * PD7 - ESD1 * PRCN - PMIC(I2C5) * LDO5 - SD Regulator 1V8-3V3 * PRMU * PD7 - ESD1 * PRTU * PD1- ESD1 * PD2 - ESD2 * PRI5 * PRTC GFXC: PR6 LDO1 PR7 LDO2 PBB4 E1V8 [PreviousDSDTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-dsdt) [NextWDSAchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/wdsa) Last updated 4 years ago Was this helpful? * [Decompile SSDT0000.bin](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#decompile-ssdt0000.bin) * [Compile SSDT0000.ASL](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#compile-ssdt0000.asl) * [What SSDT0000.ASL can tell you](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#what-ssdt0000.asl-can-tell-you) * [I2C Devices](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#i2c-devices) * [GPIOs](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#gpios) * [Interrupts](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#interrupts) * [Power Resources](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/acpi-ssdt#power-resources) Was this helpful? sun-brightdesktopmoon Copy PB2: (Exclusive, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PD1: (Exclusive, PullDefault, 0, 0, IoRestrictionOutputOnly, "\\_SB.GPIO", 0, ResourceConsumer, , ) PD7: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PDD0: (Exclusive, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PDD2: (Exclusive, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PDD7: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PH0: (Shared, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PH6: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PI5: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PL1: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PN0: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PN3: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PN7: (Shared, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PR4: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PR6: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PR6: (Shared, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PR7: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PR7: (Shared, PullDefault, 0, 0, IoRestrictionNoneAndPreserve, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS0: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS1: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS3: (Exclusive, PullDefault, 0, 0, IoRestrictionOutputOnly, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS5: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS5: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS6: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS6: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS7: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS7: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PT3: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PV0: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PV0: (Shared, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PW2: (Shared, PullUp, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PW3: (Shared, PullUp, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PBB0: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PBB4: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PBB7: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) PCC7: (Exclusive, PullDefault, 0, 0, IoRestrictionNone, "\\_SB.GPIO", 0, ResourceConsumer, , ) Copy PI5: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0x1388, "\\_SB.GPIO", 0, ResourceConsumer, , ) PJ0: (Edge, ActiveHigh, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PJ0: (Edge, ActiveHigh, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PK2: (Level, ActiveLow, Shared, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PL1: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PN2: (Level, ActiveLow, Shared, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PN7: (Edge, ActiveBoth, Shared, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PN7: (Edge, ActiveBoth, Shared, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS0: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS0: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS5: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS5: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS6: (Edge, ActiveBoth, Shared, PullUp, 0x9c4, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS6: (Edge, ActiveBoth, Shared, PullUp, 0x9c4, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS7: (Edge, ActiveBoth, Shared, PullUp, 0x9c4, "\\_SB.GPIO", 0, ResourceConsumer, , ) PS7: (Edge, ActiveBoth, Shared, PullUp, 0x9c4, "\\_SB.GPIO", 0, ResourceConsumer, , ) PU5: (Level, ActiveHigh, SharedAndWake, PullDown, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PU6: (Edge, ActiveLow, ExclusiveAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PV0: (Edge, ActiveHigh, SharedAndWake, PullDefault, 0x9c4, "\\_SB.GPIO", 0, ResourceConsumer, , ) PV0: (Edge, ActiveHigh, SharedAndWake, PullDefault, 0x9c4, "\\_SB.GPIO", 0, ResourceConsumer, , ) PW2: (Edge, ActiveBoth, SharedAndWake, PullUp, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PW3: (Edge, ActiveBoth, Shared, PullUp, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PBB6: (Level, ActiveLow, Shared, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PDD3: (Edge, ActiveBoth, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) PDD3: (Level, ActiveLow, ExclusiveAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) sun-brightdesktopmoon --- # Dump Bootrom | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#idea) Idea --------------------------------------------------------------------------------------------------------------------- [https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switcharrow-up-right](https://media.ccc.de/v/c4.openchaos.2018.06.glitching-the-switch) dumping boot rom seems easy. only need to set the right access bits. which we can do since we have total control over the CPU/memory. Reverse engineering is the hard part. 48kB arm assembler. And only some bits decide from which device is booted from. But we have a good starting point. The provided example patches a function which prevents the bootrom to read the BCT. We need to patch some bits before this instruction is executed. and since reading the BCT is the first thing the bootrom does we should start looking at the begining of the function call chain. only need to figure out to which value we must set the byte. but this should also be easy. the bootdevice is read form a fuse. Nvidia provides a script to burn fuses. this should tell us which fuse is used for bootdevice selection and we should be able to find this address in the bootrom. it should also tell us which value the fusee needs to be to boot from mmc/sd/usb/... the theory part is "done". Need to dump the bootrom and throw the binary into ghidra. find the function which reads the boot device fuse and write an ipatch to patch the bootrom. like disableing security fuse. i hope this allows us to boot selfmade BCTs from other storage devices. luckily we dont have to do some voltage glitching. we could just set the bits to read the bootrom [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#preparation) Preparation ----------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#secureboot-registers) Secureboot registers ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MOGUxaGCFKDhW1zmW4x%252F-MOGVCUzLap8EEl-GcVg%252Ftegra2.png%3Falt%3Dmedia%26token%3D7d732de9-395f-494a-9810-7bc4ffce3d9b&width=768&dpr=3&quality=100&sign=b3ecd442&sv=2) Tegra 2 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MOGUxaGCFKDhW1zmW4x%252F-MOGVDNHRdwf8bw9j1oa%252Ftegra3.png%3Falt%3Dmedia%26token%3D404c56ec-6d46-4963-94d1-5a9a793d2d68&width=768&dpr=3&quality=100&sign=c8ecc3b1&sv=2) Tegra 3 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MOGUxaGCFKDhW1zmW4x%252F-MOGVL_veQLwBaRzF6Qv%252Ftegra4.png%3Falt%3Dmedia%26token%3D9434b5c2-0bed-46f0-99f1-775da9b3f7d3&width=768&dpr=3&quality=100&sign=ada1b171&sv=2) Tegra 4 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MOGUxaGCFKDhW1zmW4x%252F-MOGVQtA6EUqgOqHKSpE%252FtegraX1.png%3Falt%3Dmedia%26token%3D95674426-b91c-4010-ac7f-318ffbaf285e&width=768&dpr=3&quality=100&sign=6de359a&sv=2) Tegra X1 Secureboot registers should be located at 6000:c2000 ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MOGVqjGTS55SwupBIqF%252F-MOGW90qoAAyO4isQYv_%252Ftegra3SecureBootReg.png%3Falt%3Dmedia%26token%3D3f947d33-6fed-42d0-8fab-df98504a0934&width=768&dpr=3&quality=100&sign=db8cfa53&sv=2) Tegra 3 secureboot registers [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#fusee-gelee-payload) fusee gelee payload --------------------------------------------------------------------------------------------------------------------------------------------------- [PreviousKernel modulechevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support/kernel-module) [Nextgit for dummys \[WIP!\] (like me)chevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/git-for-dummys) Last updated 5 years ago Was this helpful? * [Idea](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#idea) * [Preparation](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#preparation) * [Secureboot registers](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#secureboot-registers) * [fusee gelee payload](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/dump-bootrom#fusee-gelee-payload) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Surface RT | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#misc) Misc ---------------------------------------------------------------------------------------------------------------------------- * check all ACPI PowerResources/GPIO again * check finish battery driver * check get wifi to work * check convert edid to display timings and add it to devicetree * patch UEFI Shell GOP * does WinButton work without daughter board? No: Windows button is connected to Screen digitizer * run i2c detect without daughter board (MPS430?) * add a picture for every IC and its location. * revisit i2c patch. maybe no need to patch 10bit address check * add pictures of every IC + location on mainboard * XDA update * create a lot more documentation on how i got xyz working. (identifing sensor, logic analyzer, bla bla) * check Fix devicetree always on regulators * empty I2C bus? try different pinmux; CAMS? * check BDID whith others * What is open Surface RT? OpenSource, OpenHardware, OpenedDevice * unixbench: apx vs efi * UC3L chip: SensorCollection or EmbeddedController or both? * Research how Uefi blocks LDO5 writes * Create minimal .config * check Explain the root and rootwait param * switch from UEFI shell to grub * check "shim" which sets conout before chainloading other files. * early uartE with efistub pinmux setting * check use initrd as rootfs? Yes: root=/dev/ram0 [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#apx) APX -------------------------------------------------------------------------------------------------------------------------- * apx uboot devicetree * check apx devicetree * check apx 1gb ram * check operation performance points (OPP) * check tCover * implement thermal zone * Wifi: reboot from UEFI to apx and see if wifi works. A: no [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#battery) BATTERY ---------------------------------------------------------------------------------------------------------------------------------- * check POWER\_SUPPLY\_PROP\_STATUS + polling for capacity change * POWER\_SUPPLY\_PROP\_PRESENT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#uefi) UEFI ---------------------------------------------------------------------------------------------------------------------------- * Examine all ConOut handles to see why it picks the wrong one. * Examine all ConIn handles to see if tCover is possible. [Previous!TODOchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts) [NextSurface 2chevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-2) Last updated 4 years ago Was this helpful? * [Misc](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#misc) * [APX](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#apx) * [BATTERY](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#battery) * [UEFI](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt#uefi) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Qemu emulation | Open Surface RT Emulating a arm32 UEFI device is useful for developing Linux and debugging it. In the [GDB Debugging page](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation/gdb-debugging#compile-a-correct-linux-kernel) you can find instructions on how to compile Linux for this virtual machine. circle-info A premade ZIP with all required files can be found at the bottom. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#compile-ovmf-for-qemu) Compile OVMF for qemu ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#install-required-packages) Install required packages Run the following commands to install the required packages. Copy sudo apt install python python3 python3-distutils sudo apt install gcc-arm-none-eabi sudo apt install uuid-dev sudo apt install build-essential sudo apt install bison sudo apt install flex You will need other stuff too, but that is probably already installed. (e.g. git) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#download-source) Download source You need the source code of edk2 and acpica. Copy # Go to the directory you want to work in export WORKSPACE=$PWD # Download edk2 and acpica git clone https://github.com/acpica/acpica.git git clone https://github.com/tianocore/edk2.git # Download submodules cd edk2 git submodule update --init cd .. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#compile-ovmf) Compile OVMF Go to your source directory and run the following commands. Your output OVMF firmware file for qemu is`$WORKSPACE/Build/ArmVirtQemu-ARM/RELEASEGCC5/FV/QEMU`\_`EFI.fd` [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#setup-qemu-files-and-run-it) Setup qemu files and run it ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Create a directory, where you want your files to be in. Put your `QEMU_EFI.fd` firmware file in this directory, compiled in the previous section. Now run the following commands to create some disk images: Now create a directory named `boot`. This will be your EFI partition. You can now easily place your EFI files in there. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#run-qemu) Run qemu To start your virtual machine run the following command, and make sure `qemu-system-arm` is installed. This will run qemu with 4 virtual CPU cores. They are Coretx-A15 cores. Used because it works. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#premade-files) Premade files --------------------------------------------------------------------------------------------------------------------------------------------------------------- The following ZIP includes all files setup in their proper location. In addition its EFI partition folder has a UEFI shell in it. To run it either execute the `run.sh` file or enter the command described in [Run qemu](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#run-qemu) . file-archive 2MB [arm32-uefi-qemu-setup.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MXHctaCs-rXxcbfBJRT%2F-MXHyFAub5PM5GZqroE0%2Farm32-uefi-qemu-setup.zip?alt=media&token=d18d03f3-3ad9-4008-b5ab-b67a2eb13328) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MXHctaCs-rXxcbfBJRT%2F-MXHyFAub5PM5GZqroE0%2Farm32-uefi-qemu-setup.zip?alt=media&token=d18d03f3-3ad9-4008-b5ab-b67a2eb13328) Premade qemu setup [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#references) References --------------------------------------------------------------------------------------------------------------------------------------------------------- Links where the above compiling information is from: * [https://developer.arm.com/tools-and-software/open-source-software/firmware/edkii-uefi-firmware/building-edkii-uefi-firmware-for-arm-platformsarrow-up-right](https://developer.arm.com/tools-and-software/open-source-software/firmware/edkii-uefi-firmware/building-edkii-uefi-firmware-for-arm-platforms) * [https://designprincipia.com/virtualize-uefi-on-arm-using-qemu/arrow-up-right](https://designprincipia.com/virtualize-uefi-on-arm-using-qemu/) [PreviousConfigs we already triedchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried) [NextGDB Debuggingchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation/gdb-debugging) Last updated 5 years ago Was this helpful? * [Compile OVMF for qemu](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#compile-ovmf-for-qemu) * [Install required packages](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#install-required-packages) * [Download source](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#download-source) * [Compile OVMF](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#compile-ovmf) * [Setup qemu files and run it](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#setup-qemu-files-and-run-it) * [Run qemu](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#run-qemu) * [Premade files](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#premade-files) * [References](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation#references) Was this helpful? sun-brightdesktopmoon Copy # Compile acpica tools make -C $WORKSPACE/acpica -j$(nproc) # Set environment variables export GCC5_ARM_PREFIX=arm-none-eabi- export IASL_PREFIX=$WORKSPACE/acpica/generate/unix/bin/ export PYTHON_COMMAND=/usr/bin/python3 # Configure the edk2 environment source edk2/edksetup.sh # Compile edk2 BaseTools make -C edk2/BaseTools -j$(nproc) # Compile OVMF build -a ARM -t GCC5 -p ArmVirtPkg/ArmVirtQemu.dsc -b RELEASE -j$(nproc) Copy rm -f flash0.img flash1.img dd if=/dev/zero bs=1M count=64 of=flash0.img dd if=/dev/zero bs=1M count=64 of=flash1.img dd if=QEMU_EFI.fd bs=1M of=flash0.img conv=notrunc Copy qemu-system-arm \ -m 1024 \ -cpu cortex-a15 \ -M virt \ -pflash flash0.img \ -pflash flash1.img \ -nographic \ -drive \ file=fat:rw:boot/ \ -smp '4' sun-brightdesktopmoon --- # TZ Exploit - CTS | Open Surface RT * check Read EL from APX * check Read EL from UEFI * Create Payload [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#idea) Idea ----------------------------------------------------------------------------------------------------------------------- Write code into TZ mem and jump to it. Hopefully it will execute at EL3. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#tests) Tests ------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-ns-bit) Read NS-Bit [https://developer.arm.com/documentation/ddi0406/latest/arrow-up-right](https://developer.arm.com/documentation/ddi0406/latest/) page 1697: can only be read from securemode. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-el) Read EL [https://stackoverflow.com/questions/31787617/what-is-the-current-execution-mode-exception-level-etcarrow-up-right](https://stackoverflow.com/questions/31787617/what-is-the-current-execution-mode-exception-level-etc) [http://lioncash.github.io/ARMBook/the\_apsr,\_cpsr,\_and\_the\_difference\_between\_them.htmlarrow-up-right](http://lioncash.github.io/ARMBook/the_apsr,_cpsr,_and_the_difference_between_them.html) [https://www.keil.com/pack/doc/CMSIS/Core\_A/html/group\_\_CMSIS\_\_CPSR.htmlarrow-up-right](https://www.keil.com/pack/doc/CMSIS/Core_A/html/group__CMSIS__CPSR.html) [https://www.keil.com/pack/doc/CMSIS/Core\_A/html/group\_\_CMSIS\_\_CPSR\_\_M.htmlarrow-up-right](https://www.keil.com/pack/doc/CMSIS/Core_A/html/group__CMSIS__CPSR__M.html) [https://developer.arm.com/documentation/ddi0406/latest/arrow-up-right](https://developer.arm.com/documentation/ddi0406/latest/) page: 1139 ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-el-from-apx) Read EL from APX a custom payload will be used to read the Exception Level from in APX mode. I expect it to be 3. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MX2GWa0yBkEeZgMoRbU%252F-MX2PRxduOWt1YvgMR-h%252Fimage.png%3Falt%3Dmedia%26token%3D82b00268-c6c7-41f8-aa7f-32fe077e88b2&width=768&dpr=3&quality=100&sign=9b218e2f&sv=2) #define CPSR\_M\_SVC 0x13U Supervisor mode is the default mode to which a Supervisor Call exception is taken. file-download 8KB [payload.c](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MX2GWa0yBkEeZgMoRbU%2F-MX2PfgKBQewSvS6Nk1f%2Fpayload.c?alt=media&token=8931c834-610e-4a52-ab15-fdc86066c155) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MX2GWa0yBkEeZgMoRbU%2F-MX2PfgKBQewSvS6Nk1f%2Fpayload.c?alt=media&token=8931c834-610e-4a52-ab15-fdc86066c155) FuseeGelee Payload to read EL from APX ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-el-from-uefi) Read EL from UEFI A normal efi App will be used to read the Execption Level from UEFI. I expect it to be 0. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MX2GWa0yBkEeZgMoRbU%252F-MX2ZAd73Yp4H7vgNzQ4%252FEL_UEFI.jpg%3Falt%3Dmedia%26token%3Da14ab6ab-e435-428b-8584-ea2d5a02af1b&width=768&dpr=3&quality=100&sign=e9610c80&sv=2) #define CPSR\_M\_FIQ 0x11U FIQ mode is the default mode to which an FIQ interrupt is taken. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#creating-a-payload) Creating a payload --------------------------------------------------------------------------------------------------------------------------------------------------- We need a relocateable payload since UEFI can give us different load addresses everytime. Therefore we need to use Position independent code: [https://stackoverflow.com/questions/6324257/load-time-base-address-cortex-m3-bare-metalarrow-up-right](https://stackoverflow.com/questions/6324257/load-time-base-address-cortex-m3-bare-metal) [https://stackoverflow.com/questions/5311515/gcc-fpic-optionarrow-up-right](https://stackoverflow.com/questions/5311515/gcc-fpic-option) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#step-by-step) Step by Step --------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#step-1) Step 1: Create payload which reads EL and reports back via serial. Read payload from USB/eMMC to memory. Disable TZ protection. copy payload into TZ mem. override TZ with jumps to payload address. If payload reads EL3 continue. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#step-2) Step 2: to be continued... [https://developer.arm.com/documentation/ddi0406/b/System-Level-Architecture/The-System-Level-Programmers--Model/Exceptions/Exception-vectors-and-the-exception-base-address?lang=enarrow-up-right](https://developer.arm.com/documentation/ddi0406/b/System-Level-Architecture/The-System-Level-Programmers--Model/Exceptions/Exception-vectors-and-the-exception-base-address?lang=en) [Previousbatterychevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/battery) [NexttCover Linux supportchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support) Last updated 5 years ago Was this helpful? * [Idea](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#idea) * [Tests](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#tests) * [Read NS-Bit](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-ns-bit) * [Read EL](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-el) * [Read EL from APX](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-el-from-apx) * [Read EL from UEFI](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#read-el-from-uefi) * [Creating a payload](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#creating-a-payload) * [Step by Step](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#step-by-step) * [Step 1:](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#step-1) * [Step 2:](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts#step-2) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Device Tables | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables#extraction) Extraction ------------------------------------------------------------------------------------------------------------- The extraction of these tables was done with UEFI shell. Because there is no display output on the sRT unless you patch the GOP we used a startup script. You can download these files in zip below. You can get information about the commands used here: [https://www.uefi.org/sites/default/files/resources/UEFI\_Shell\_2\_2.pdfarrow-up-right](https://www.uefi.org/sites/default/files/resources/UEFI_Shell_2_2.pdf) (Chapter 5) file-archive 276KB [device-table-extraction.zip](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl59QjHZ_xR4lT7c2i%2Fdevice-table-extraction.zip?alt=media&token=f99739f9-9196-4741-94dd-7acaad9e2aa3) archive downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl59QjHZ_xR4lT7c2i%2Fdevice-table-extraction.zip?alt=media&token=f99739f9-9196-4741-94dd-7acaad9e2aa3) [hashtag](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables#output) Output ----------------------------------------------------------------------------------------------------- file-download 3KB [devices.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5DDjr_ngn2QXRxC_%2Fdevices.txt?alt=media&token=fe2c9afe-e192-4ec6-8d88-62625b16f017) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5DDjr_ngn2QXRxC_%2Fdevices.txt?alt=media&token=fe2c9afe-e192-4ec6-8d88-62625b16f017) devices file-download 4KB [devices-sfo.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5NPbRWa0qZeFGXsG%2Fdevices-sfo.txt?alt=media&token=812750bc-52a0-4e17-8adf-ce7d3140d700) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5NPbRWa0qZeFGXsG%2Fdevices-sfo.txt?alt=media&token=812750bc-52a0-4e17-8adf-ce7d3140d700) file-download 2KB [devtree.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5OyzkiZ7BzaI9_xa%2Fdevtree.txt?alt=media&token=f13f7c18-eb38-45ed-ae05-20355ccfc024) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5OyzkiZ7BzaI9_xa%2Fdevtree.txt?alt=media&token=f13f7c18-eb38-45ed-ae05-20355ccfc024) file-download 24KB [dh.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5U0asLdfhBX7A5Mp%2Fdh.txt?alt=media&token=fc32d067-4471-4d60-9110-797535f9ecc9) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MKl4d3uXl8HzxEgkU8h%2F-MKl5U0asLdfhBX7A5Mp%2Fdh.txt?alt=media&token=fc32d067-4471-4d60-9110-797535f9ecc9) [PreviousMemory Mappingchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/memory-mapping) [NextPinMuxchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/pinmux) Last updated 5 years ago Was this helpful? * [Extraction](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables#extraction) * [Output](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/device-tables#output) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # FPDT | Open Surface RT [PreviousFACPchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/facp) [NextMSDMchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/msdm) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # tCover Linux support | Open Surface RT I2C0 @ 0x00 Address 0x00 is general call address which makes Cover incompatible with standard I2C drivers. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support#wdsa-table) WDSA Table ----------------------------------------------------------------------------------------------------------------------------------------- Copy Name(ABUF, ResourceTemplate() { I2CSerialBus(0, ControllerInitiated, 0x61a80, AddressingMode7Bit, "\\_SB.I2C1", 0, ResourceConsumer, , ) GpioInt(Level, ActiveLow, Shared, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) {0x59} }) Name(EBUF, ResourceTemplate() { I2CSerialBus(0, ControllerInitiated, 0x61a80, AddressingMode7Bit, "\\_SB.I2C1", 0, ResourceConsumer, , ) GpioInt(Level, ActiveLow, SharedAndWake, PullDefault, 0, "\\_SB.GPIO", 0, ResourceConsumer, , ) {0x75} }) Address 0x00; Speed 400kHz GPIO Interrupts: 0x59 -> L1 0x75 -> O5 [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Flearn.microsoft.com%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=80cb8db5&sv=2)HID Over I2C Protocol Specification - Windows 10 hardware devMicrosoftLearnchevron-right](https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn642101(v=vs.85)?redirectedfrom=MSDN) [![Logo](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2Flearn.microsoft.com%2Ffavicon.ico&width=20&dpr=3&quality=100&sign=80cb8db5&sv=2)HIDI2C Device-Specific Method (\_DSM) - Windows driversMicrosoftLearnchevron-right](https://docs.microsoft.com/en-us/windows-hardware/drivers/bringup/hidi2c-device-specific-method---dsm-) ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-McNhbyY3PwPkJ3Gn-Iu%252F-McNiHtnQxH5dKjdrn2m%252Fimage.png%3Falt%3Dmedia%26token%3D3d0ba987-ef0c-4283-98d5-b1b5d4eb1bdc&width=768&dpr=3&quality=100&sign=12eaa811&sv=2) Captured HID Descriptor without tCover [https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjW9vvHiZ7xAhWLh\_0HHf3LC2kQFjAAegQIBRAD&url=http%3A%2F%2Fdownload.microsoft.com%2Fdownload%2F7%2Fd%2Fd%2F7dd44bb7-2a7a-4505-ac1c-7227d3d96d5b%2Fhid-over-i2c-protocol-spec-v1-0.docx&usg=AOvVaw32joJ2ViKHgpCbccKBdj2Awww.google.comchevron-right](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjW9vvHiZ7xAhWLh_0HHf3LC2kQFjAAegQIBRAD&url=http%3A%2F%2Fdownload.microsoft.com%2Fdownload%2F7%2Fd%2Fd%2F7dd44bb7-2a7a-4505-ac1c-7227d3d96d5b%2Fhid-over-i2c-protocol-spec-v1-0.docx&usg=AOvVaw32joJ2ViKHgpCbccKBdj2A) From 5.1.1 HID Descriptor Format Offset Field Size Actual Value Comment 0 wHIDDescLength 2 00 1E Dec: 30 -> 30 Bytes read 2 bcdVersion 2 01 00 Version 1.00 4 wReportDescLength 2 00 00 x 6 wReportDescRegister 2 00 42 maybe 8 wInputRegister 2 00 43 maybe 10 wMaxInputLength 2 00 00 x 12 wOutputRegister 2 00 44 maybe 14 wMaxOutputLength 2 00 00 x 16 wCommandRegister 2 00 45 maybe 18 wDataRegister 2 00 46 maybe 20 wVendorID 2 00 00 x 22 wProuctID 2 00 00 x 24 wVersionID 2 00 00 x 26 RESERVED 4 00 00 00 00 **All important information** is set to 0x00. I guess standard I2C HID Driver will have a hard time. HID Descriptor Address is 0x41. This makes all the Register fields seem legit. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support#whats-wrong-here) Whats wrong here? ------------------------------------------------------------------------------------------------------------------------------------------------------ It was tested without tCover. Connecting a tCover doesn't change anything. This should be related to wrong power settings. Surface RT2 turns on backlight on TypeCover2 when the kernel is booted from UEFI with ACPI. ACPI does something right according to power settings. Now we need to capture the new HID Descriptor for UEFI boot on Surface RT. Results should show what to do next [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support#observation) Observation ------------------------------------------------------------------------------------------------------------------------------------------- Booting Windows without tCover: Windows doesn't send a single byte to tCover. Booting Windows with tCover: Windows does send some non HID bytes before the HID Descriptor is read. That leads to the conclusion that the SoC has a GPIO which acts as tCover detector. [PreviousTZ Exploit - CTSchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts) [NextKernel modulechevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support/kernel-module) Last updated 4 years ago Was this helpful? * [WDSA Table](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support#wdsa-table) * [Whats wrong here?](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support#whats-wrong-here) * [Observation](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tcover-linux-support#observation) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # UEFI Privilege Escalation: Execute code in Secure mode | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#the-idea) The idea -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Using the [Yahallo exploitarrow-up-right](https://github.com/NekomimiRouter/yahallo/) we can get access to Trustzone memory. In the Trustzone you can find all of the firmware's functionality, where some code executes in Secure mode. On top of that, some of the memory is marked as secure, so you can execute it from Secure mode. The goal is to get rid of Trustzone memory, so the page tables of the Trustzone memory need to be modified. To do this you need to be in the [Secure mode](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#reading-mvbar) . But how do you get into Secure mode? UEFI firmware provides runtime services to the running operating system. The communication happens with ACPI or other protocols. But also with interrupts, specifically the Secure Monitor Call (SMC). A user can trigger a SMC by executing the `smc` instruction. See the [SMC Calling Conventionarrow-up-right](https://developer.arm.com/documentation/den0028/d/) for more information on how such a call happens. When executing a SMC, the processor receives the interrupt and looks in the Monitor Vector Table at the Monitor Vector Base (specified in the Monitor Vector Base Address Register (MVBAR)) for the address of the Secure Monitor and jumps to it. The Secure Monitor is then responsible for reading the variables from the SMC and **running** the desired function **in** **Secure mode**\*. Essentially SMCs are used for communicating with the Secure world and the Trustzone kernel. When you further think about it, you may notice that we could simply replace the Secure Monitor and put our own code there, by using the Yahallo exploit. \* The Secure Monitor executes in Monitor mode. Monitor mode ignores the SCR.NS bit and always executes in secure mode. You can use this to modify configurations which are specific to each execution state. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#finding-mvbar) Finding MVBAR ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ To replace the Secure Monitor, you first need to locate it. The Monitor Vector Base Address Register points to the Monitor Vector Table, where the third table entry points to the Secure Monitor ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252F7FdeLqALipjFtytb48ld%252FMonitorVectorTableStructure.jpg%3Falt%3Dmedia%26token%3D8a941132-1e31-4f3c-81ed-ef0255c423f9&width=768&dpr=3&quality=100&sign=f35a5fe5&sv=2) Typical structure of a Monitor Vector Table. Additional Resource #1 ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#reading-mvbar) Reading MVBAR So just read the MVBAR, right? ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252FcwhIGYi2s8F8twjr2yOw%252FMVBAR_Usage%2520_constraints.jpg%3Falt%3Dmedia%26token%3D62ee13b6-8c73-4cf8-b7c5-769ae10ab743&width=768&dpr=3&quality=100&sign=c8b54d4&sv=2) Usage restriction of the MVBAR. Additional Resource #2 #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#but-what-are-the-secure-pl1-modes) But what are the Secure PL1 modes? ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252F7jjOk8u3nPcFAbzujOaU%252FARM-operating-modes.jpg%3Falt%3Dmedia%26token%3D2d34091d-dfea-4761-a9cf-8e1e3a00052b&width=768&dpr=3&quality=100&sign=dca4edea&sv=2) ARM operating modes/states. Additional Resource #3 So they are only accessible from Secure state. A normal UEFI App executes at PL1 in non-Secure mode. So reading the register at runtime won't work. But there are other options to get the address. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#reverse-engineering-the-firmware-binary) Reverse-engineering the firmware binary You can get your UEFI firmware binary from `C:\Windows\Firmware\SurfaceRTUEFI.bin`. For reverse engineering we have used Ghidra. For importing make sure to use `ARM:LE:32:V7:default` as language. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252F0VoBnC6E3xdP8rYa6YU6%252FGhidra-language-setting.png%3Falt%3Dmedia%26token%3D17a10a23-c6b3-4847-933f-01952da0a8a3&width=768&dpr=3&quality=100&sign=46d3d338&sv=2) Ghidra language setting `mcr p15,0x0,r0,cr12,cr0,0x1` is the instruction which sets MVBAR. Search for it. You should only find one result. The disassembly looks something like this: ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252FlATmid5gHq76uezKrUxa%252FMVBAR-function-in-surfacertuefi.png%3Falt%3Dmedia%26token%3D39ff0400-f971-4ccb-b857-8b0894f68863&width=768&dpr=3&quality=100&sign=7e7c6d1&sv=2) This is the function that sets MVBAR in the SurfaceRTUEFI.bin binary When further analyzing this, you will quickly notice that you will not be able to find out MVBAR by just analyzing the UEFI binary. Maybe it's possible, but only with heavy reverse-engineering. As you might have thought, there is an easier way to get the value of MVBAR. ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#analyzing-a-memory-dump) Analyzing a memory dump #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#dump-memory) Dump memory To analyze a memory dump you need to create one first. Our [github repositoryarrow-up-right](https://github.com/Open-Surface-RT/UEFIPrivilegeEscalationPkg) also compiles into a memory dump tool, modify [MemoryDumpTool/App.carrow-up-right](https://github.com/Open-Surface-RT/UEFIPrivilegeEscalationPkg/blob/main/MemoryDumpTool/App.c) if you need to change the memory address. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#analyzing-and-importing-the-dump) Analyzing and importing the dump Import the dump to Ghidra. Use the setting from above, but make sure to go to options and set the Base Address to `80000000`. This is where the memory dump started from. After this change continue the import as usual. But what now? You have Megabytes of memory, and you need to pick an exact point out of it. Of course we read the handful of existing and useful blog posts that are on the internet. Including this one: [https://fredericb.info/2014/12/analysis-of-nexus-5-monitor-mode.htmlarrow-up-right](https://fredericb.info/2014/12/analysis-of-nexus-5-monitor-mode.html) It shows how a Monitor Vector Table looks like, when disassembled: ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MJQb34R_xPz0ll0scbM%252Fuploads%252Fq55QWj7VXzGgjuuzLpFy%252FMonitor%2520Vector%2520Table%2520disassembled%2520-%2520Analysis%2520of%2520Nexus%25205%2520Monitor%2520mode.png%3Falt%3Dmedia%26token%3D2bd438bd-bab2-4751-bd6f-f455b996a212&width=768&dpr=3&quality=100&sign=ab8c3b22&sv=2) Monitor Vector Table disassembled So only search for some branch instructions, right? Not really. There are a lot of jump tables in the memory dump. After hours upon hours of starring at Ghidra and the internet, I managed to find the right one. I searched for multiple branch instructions next to each other using this command `xxd "trustzone.bin" | grep -E '(.{3}00 00ea){4}'` (CTS helped me with that command) I just went through the results and found a jump table at `0x811f8000`. At that point I already had an EFI app which loads a payload into memory, copies it to a desired location in the Trustzone and then fills some memory with an instruction to load the payload location into a register and an instruction to branch to this register. The payload was capable of printing something to UART. I have also tried other jump tables at that time, with no success. But this time it was different: The payload started executing. So it was clear: **MVBAR is** `**0x811f8000**` [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#the-trustzone-payload) The Trustzone payload ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#where-to-put-the-payload-in-memory) Where to put the payload in memory Right now the payload is placed at `0x8011219c`. When analyzing a memory dump you will notice that this is right after an instruction is executed which sets SCR.NS. In theory you will not need to place the payload exactly there. You could also place it before the SCR.NS set, you will always execute in secure mode, as described above. In theory you could also just replace a single Secure Monitor "Function" (When you pass paramteres to a SMC you specify what to do in the Secure Monitor). TODO: Add picture of Ghidra with the memory location ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#compiling-a-relocateable-payload) Compiling a relocateable payload circle-info You can find a fully working payload example on [GitHubarrow-up-right](https://github.com/Open-Surface-RT/UEFIPrivilegeEscalationPkg/tree/main/payload) . It includes the Makefile, a linker script, an assembly file and a C source file. Our payload is position independet, this means it can execute from anywhere in memory. It's really easy to make GCC compile position independet: Just add `-fpic` to the CFlags. (Yes, the payload is written in C, other languages such as C++ or Rust may be useable too). #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#using-assembler-language) Using Assembler language When configuring a large amout of registers, using a seperate .S/.asm file is more convinient than using inline assembly. But there is something worth knowing: You need to make sure that your assembly is relocatable, otherwise the code will break. In C the compiler makes the code reloactable, but the assembler can't make the assembly relocateable for you. Here is a short example of an assembly file which loads the address of `mybuffer` into r0: What to explain: * How the payload works and how it is executed and why exactly the strange memory location * verifying that payload executes in Secure mode * explain monitor mode a bit more (maybe) * what to do now * maybe how to use ghidra [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#additional-resources) Additional resources -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 1. [Structure of Vector Tablesarrow-up-right](https://developer.arm.com/documentation/ddi0406/c/System-Level-Architecture/The-System-Level-Programmers--Model/Exception-handling/Exception-vectors-and-the-exception-base-address?lang=en#BEIEABGJ) (Including Monitor Vector Table) 2. [Monitor Vector Base Address Registerarrow-up-right](https://developer.arm.com/documentation/ddi0406/c/System-Level-Architecture/System-Control-Registers-in-a-VMSA-implementation/VMSA-System-control-registers-descriptions--in-register-order/MVBAR--Monitor-Vector-Base-Address-Register--Security-Extensions?lang=en) 3. [ARM Processor Modes and Registersarrow-up-right](https://developer.arm.com/documentation/den0013/d/ARM-Processor-Modes-and-Registers) (Figure 3.3) [PreviousYahallo: Free memory accesschevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/yahallo-free-memory-access) [NextRemoving trustzonechevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone) Last updated 4 years ago Was this helpful? * [The idea](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#the-idea) * [Finding MVBAR](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#finding-mvbar) * [Reading MVBAR](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#reading-mvbar) * [Reverse-engineering the firmware binary](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#reverse-engineering-the-firmware-binary) * [Analyzing a memory dump](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#analyzing-a-memory-dump) * [The Trustzone payload](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#the-trustzone-payload) * [Where to put the payload in memory](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#where-to-put-the-payload-in-memory) * [Compiling a relocateable payload](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#compiling-a-relocateable-payload) * [Additional resources](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode#additional-resources) Was this helpful? sun-brightdesktopmoon Copy # This should link into the .text section .text # Define a buffer with the size of 16 bytes mybuffer: .word 16 # Make assembly_code available globally (so it can be used in C code) .global assembly_code .type assembly_code, function assembly_code: # Push the return address to the stack # Do this if you branch push {lr} # Load the address of mybuffer into memory # This is the important line. # ldr r0, =mybuffer doesn't work adr r0, mybuffer # Get the return address back from the stack pop {pc} sun-brightdesktopmoon --- # TMP2 | Open Surface RT [PreviousRSDPchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/rsdp) [NextXSDTchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/xsdt) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # DBG2 | Open Surface RT [PreviousCSRTchevron-left](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/csrt) [NextFACPchevron-right](https://open-rt.gitbook.io/open-surfacert/surface-rt/uefi/acpi-tables/not-interesting-yet/facp) Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # EFI Signing / Secure Boot | Open Surface RT circle-info Windows bootmanager exploit is deprecated, as you can now disable secure boot. Without secure boot you don't need to sign your EFI binaries. Visit [Yahallo](https://open-rt.gitbook.io/open-surfacert/common/boot-sequence/uefi/secure-boot/disable-secureboot) for more information. SurfaceRT/2 uses UEFI Secure Boot. We have a test key that can be used to sign our EFI binaries so that they are trusted by the windows boot manager. (When secure boot is enabled). [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-signing-secure-boot#working-test-key) Working Test Key ------------------------------------------------------------------------------------------------------------------------------------------------------------ 5D7630097BE5BDB731FC40CD4998B69914D82EAD CN=Windows OEM Test Cert 2017 (TEST ONLY), O=Microsoft Partner, OU=Windows, L=Redmond, S=Washington, C=US can use signtool on windows to sign our EFI builds eg `signtool.exe sign /tr http://timestamp.digicert.com /td sha1 /fd sha1 /sm /sha1 5d7630097be5bdb731fc40cd4998b69914d82ead *.efi` [PreviousVSCode integrationchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation/gdb-debugging/vscode-integration) [NextGRUB2 Booting Noteschevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/grub2-booting-notes) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # battery | Open Surface RT [https://www.kernel.org/doc/html/latest/power/power\_supply\_class.htmlarrow-up-right](https://www.kernel.org/doc/html/latest/power/power_supply_class.html) [https://elixir.bootlin.com/linux/latest/source/include/linux/power\_supply.h#L96arrow-up-right](https://elixir.bootlin.com/linux/latest/source/include/linux/power_supply.h#L96) [PreviousSurface 2chevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-2) [NextTZ Exploit - CTSchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/tz-exploit-cts) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Removing trustzone | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#details-of-the-cpu) Details of the CPU ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The Surface RT's Tegra 3 SOC's CPU uses Cortex-A9 cores. These cores use Virtual Memory System Architecture (VMSA), this means we have a Memory Management Unit (MMU). ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#arm-architecture-reference-manual-armv7-a-and-r-edition) ARM Architecture Reference Manual ARMv7 A & R edition This manual describes the ARMv7 A & R architecture (ARMv7 A is important for us) in Application Level Architecture and in System Level Architecture. The System Level Architecture is the interesting part for this type of development. Part B, System Level Architecture, only has 874 pages to read 🥳. Download the manual here: [https://developer.arm.com/documentation/ddi0406/latestarrow-up-right](https://developer.arm.com/documentation/ddi0406/latest) ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#why-modify-page-tables) Why modify page tables? The MMU is also used for virtual addressing, not only for protected memory. Virtual addressing is necessary for most applications and operating systems. Linux works without it, but most programs don't work without virtual addressing. Because of that we need to enable the MMU for linux, but when MMU is enabled, it blocks access to trustzone memory, so the trustzone memory needs to be unmapped by modifying the page tables of the Cortex-A9 cores. [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#advantage) Advantage ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The advantage of completely eliminating UEFI and TrustZone is, that we don't need to modify the linux source code, only a device tree is needed, which can be mainlined. Without getting this way to work, our linux work probably won't be mainlined ever. [PreviousUEFI Privilege Escalation: Execute code in Secure modechevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/uefi-privilege-escalation-execute-code-in-secure-mode) [NextEFI linux bootingchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting) Last updated 4 years ago Was this helpful? * [Details of the CPU](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#details-of-the-cpu) * [ARM Architecture Reference Manual ARMv7 A & R edition](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#arm-architecture-reference-manual-armv7-a-and-r-edition) * [Why modify page tables?](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#why-modify-page-tables) * [Advantage](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/uefi-privilege-escalation-exploit-documentation/removing-trustzone#advantage) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # Configs we already tried | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#surface-rt-1) Surface RT 1 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- ### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#leanders-trial-and-fail) @Leander's trial and fail _Note to members of the gitbook: I don't know if it is useful to make this person-specific._ #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-001) #001 This hangs at without supplying device tree with dtb= If device tree is supplied, cpuidle complains at printed. `[ 0.000000] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 0.000000] cfg80211: failed to load regulatory.db` file-download 163KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSn9s-iosQb9ehOUWkO%2F-MSnA9w12Hg9YJgUXVJE%2F.config?alt=media&token=aa756bba-3ead-4be8-835f-0721c2b5269f) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSn9s-iosQb9ehOUWkO%2F-MSnA9w12Hg9YJgUXVJE%2F.config?alt=media&token=aa756bba-3ead-4be8-835f-0721c2b5269f) #001 .config file-download 6KB [tegra30-microsoft-surfaceRT-test1.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSn9s-iosQb9ehOUWkO%2F-MSnASfpu41_qXPeVXwy%2Ftegra30-microsoft-surfaceRT-test1.dts?alt=media&token=0679639d-1520-468c-b0fc-f0722075338c) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSn9s-iosQb9ehOUWkO%2F-MSnASfpu41_qXPeVXwy%2Ftegra30-microsoft-surfaceRT-test1.dts?alt=media&token=0679639d-1520-468c-b0fc-f0722075338c) #001 device tree circle-info Testing without device tree from here on #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-002) #002 Changed:`CONFIG_CFG80211=n` `[ 0.000000] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 0.000000] cfg80211: failed to load regulatory.db` This is issue doesn't exist anymore, it just freezes at `[ 0.000000] Freeing unused kernel memory: 1024K` Note the line, clock should be 100kHz`[ 0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 21474836475000000ns` `[ 0.000000] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled` `[ 0.000000] Warning: unable to open an initial console.` It looks like it's using some serial and then is unable to open a console. -> No device tree so it doesn't know /dev/ttyS0 (UART-A) file-download 160KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnBV8VpF11hoy9BmAP%2F-MSnCT88NM0dgvjC7teI%2F.config?alt=media&token=1732e81e-f86f-4f74-87fa-2f176640bb19) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnBV8VpF11hoy9BmAP%2F-MSnCT88NM0dgvjC7teI%2F.config?alt=media&token=1732e81e-f86f-4f74-87fa-2f176640bb19) #002 .config file-download 12KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnDEK9w1QmBAL4z7AV%2F-MSnDaYdQGLGv7EKDRmV%2Flog.txt?alt=media&token=af803d6e-3e9a-4102-b701-6c302ad58d57) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnDEK9w1QmBAL4z7AV%2F-MSnDaYdQGLGv7EKDRmV%2Flog.txt?alt=media&token=af803d6e-3e9a-4102-b701-6c302ad58d57) #002 log #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-003) #003 `CONFIG_FB_EFI=y CONFIG_CMDLINE="console=ttyS0,115200 console=tty0 earlyprintk initcall_debug sched_debug lpj=10000"` It booted, then disabled uart and printed to the screen. Log only contains print from uart. Stuck at the same line. file-download 159KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnKRHgVdb1hCMQ2RPj%2F-MSnLiGINTTvQmEd39BF%2F.config?alt=media&token=9ae771a9-e4a0-4446-8ca8-afd2f6d60653) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnKRHgVdb1hCMQ2RPj%2F-MSnLiGINTTvQmEd39BF%2F.config?alt=media&token=9ae771a9-e4a0-4446-8ca8-afd2f6d60653) #003 .config file-download 5KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnKRHgVdb1hCMQ2RPj%2F-MSnLq6zZNHbI6ALVFOp%2Flog.txt?alt=media&token=78d6160f-3609-4ebd-b541-578b8c775a4a) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnKRHgVdb1hCMQ2RPj%2F-MSnLq6zZNHbI6ALVFOp%2Flog.txt?alt=media&token=78d6160f-3609-4ebd-b541-578b8c775a4a) #003 log #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-004) #004 `CONFIG_CMDLINE="console=ttyS0,115200 console=tty0 earlycon earlyprintk initcall_debug sched_debug lpj=10000"` Log should be the same apart from the cmdline. Again, it displayed to display, so log doesn't include that output. file-download 160KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnYWsdidk05bSru3K7%2F-MSnZimbmanlZ2ZVAekv%2F.config?alt=media&token=0b1603d2-fa44-48bc-b049-5d56667cb12d) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnYWsdidk05bSru3K7%2F-MSnZimbmanlZ2ZVAekv%2F.config?alt=media&token=0b1603d2-fa44-48bc-b049-5d56667cb12d) #004 .config file-download 5KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnYWsdidk05bSru3K7%2F-MSn_AIkXqHKAh4Lo7D5%2Flog.txt?alt=media&token=2847f559-9776-428d-8a19-e4bc2215c4f2) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnYWsdidk05bSru3K7%2F-MSn_AIkXqHKAh4Lo7D5%2Flog.txt?alt=media&token=2847f559-9776-428d-8a19-e4bc2215c4f2) #004 log #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-005) #005 `CONFIG_CMDLINE="console=ttyS0,115200 earlycon earlyprintk initcall_debug sched_debug lpj=10000"` Screen with a cursor, all output on uart. But because there is no device tree, no console from initrd. file-download 159KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnaGOUaKppmNnSzhTc%2F-MSnbE9RfEUt8GgFjund%2F.config?alt=media&token=22495359-7d27-4d4e-8d61-4c3782d18482) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnaGOUaKppmNnSzhTc%2F-MSnbE9RfEUt8GgFjund%2F.config?alt=media&token=22495359-7d27-4d4e-8d61-4c3782d18482) #005 .config file-download 13KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnaGOUaKppmNnSzhTc%2F-MSnbNyW1jYeZS-cfUB6%2Flog.txt?alt=media&token=bf58f86b-5878-438a-ba4f-bbd7a505927e) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnaGOUaKppmNnSzhTc%2F-MSnbNyW1jYeZS-cfUB6%2Flog.txt?alt=media&token=bf58f86b-5878-438a-ba4f-bbd7a505927e) #005 log circle-info Testing with device tree from here on #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-006) #006 Nothing changed in config. Only added device tree. Kernel panic: `[ 0.000000] Unable to handle kernel NULL pointer dereference at virtual address 00000010`Has to do with cpuidle. You can also see complaints about a bad device tree. file-download 159KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnbWcQHh3WZXffnGYi%2F-MSngW7QyDlKlOoMUFid%2F.config?alt=media&token=6d575e61-a746-4870-b91b-74141f5d0d80) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnbWcQHh3WZXffnGYi%2F-MSngW7QyDlKlOoMUFid%2F.config?alt=media&token=6d575e61-a746-4870-b91b-74141f5d0d80) #006 .config file-download 18KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnbWcQHh3WZXffnGYi%2F-MSngaQgcMCr2gT55Lsk%2Flog.txt?alt=media&token=892baa06-b056-4687-82bd-21c36193808c) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnbWcQHh3WZXffnGYi%2F-MSngaQgcMCr2gT55Lsk%2Flog.txt?alt=media&token=892baa06-b056-4687-82bd-21c36193808c) #006 log file-download 2KB [tegra30-microsoft-surfaceRT.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSngeyFwq5wPE3ldNtG%2F-MSnhbfhtcuy59FQrmnU%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=0166b919-d7c5-4c9b-8e59-92f797b6ad91) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSngeyFwq5wPE3ldNtG%2F-MSnhbfhtcuy59FQrmnU%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=0166b919-d7c5-4c9b-8e59-92f797b6ad91) #006 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-007) #007 Only device tree edits. Screen has no cursor anymore, only backlight is turned on. You can't print something on it with `echo hello >> /dev/fb0` or `echo hello >> /dev/tty0` Successful boot to Buildroot. Note: Log has a lot of entries two times. file-download 159KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnhf4_gwGiW4Ze-7YG%2F-MSnkCEMPj8ZUJX_MSKr%2F.config?alt=media&token=720fa6e9-221d-48ba-989f-a40890e07442) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnhf4_gwGiW4Ze-7YG%2F-MSnkCEMPj8ZUJX_MSKr%2F.config?alt=media&token=720fa6e9-221d-48ba-989f-a40890e07442) #007 .config file-download 30KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnhf4_gwGiW4Ze-7YG%2F-MSnkGBUkCIh5nk8giix%2Flog.txt?alt=media&token=8a679a3c-f92d-4828-b162-800dbec66fb3) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnhf4_gwGiW4Ze-7YG%2F-MSnkGBUkCIh5nk8giix%2Flog.txt?alt=media&token=8a679a3c-f92d-4828-b162-800dbec66fb3) #007 log file-download 2KB [tegra30-microsoft-surfaceRT.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnhf4_gwGiW4Ze-7YG%2F-MSnkJpxgKZD6DDTVwav%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=3cd88443-96e0-49a5-9dcc-ec1bc66c3959) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnhf4_gwGiW4Ze-7YG%2F-MSnkJpxgKZD6DDTVwav%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=3cd88443-96e0-49a5-9dcc-ec1bc66c3959) #007 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-008) #008 `CONFIG_VGA_ARB=n CONFIG_TEGRA_HOST1X=n CONFIG_DRM=n` No different screen behaviour. Log has some commands at the bottom. file-download 156KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnknNYh8Hy721cjM4v%2F-MSns7afEkh0JYZsE4FA%2F.config?alt=media&token=f4238e92-3a85-47ad-bee7-e80d84528210) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnknNYh8Hy721cjM4v%2F-MSns7afEkh0JYZsE4FA%2F.config?alt=media&token=f4238e92-3a85-47ad-bee7-e80d84528210) #008 .config file-download 18KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnknNYh8Hy721cjM4v%2F-MSnsHCp4Xi6CPsknZoh%2Flog.txt?alt=media&token=a556f87b-7c8d-4757-ab47-b26fce933c35) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnknNYh8Hy721cjM4v%2F-MSnsHCp4Xi6CPsknZoh%2Flog.txt?alt=media&token=a556f87b-7c8d-4757-ab47-b26fce933c35) #008 log file-download 2KB [tegra30-microsoft-surfaceRT.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnknNYh8Hy721cjM4v%2F-MSnsTt48sqYrNLJauuH%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=094144ec-3505-4458-88ba-b1745ecb68b4) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSnknNYh8Hy721cjM4v%2F-MSnsTt48sqYrNLJauuH%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=094144ec-3505-4458-88ba-b1745ecb68b4) #008 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-009) #009 No config changed. Only device tree edits. Added nodes to it until dtc didn't complain about anything. Some strange screen behaviour. `[ 0.000000] tegra20-cpufreq tegra20-cpufreq: operating points not found [ 0.000000] tegra20-cpufreq tegra20-cpufreq: please update your device tree` Looks like some cpu frequency nodes have to be added to device tree. file-download 155KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqqu8wLZ6-hRXzwPsp%2F-MSqvzbzMBHt1XZERzBN%2F.config?alt=media&token=9ee6e685-9fb8-41d7-b4d0-f73a1b03b3d9) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqqu8wLZ6-hRXzwPsp%2F-MSqvzbzMBHt1XZERzBN%2F.config?alt=media&token=9ee6e685-9fb8-41d7-b4d0-f73a1b03b3d9) #009 .config file-download 17KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqqu8wLZ6-hRXzwPsp%2F-MSqw6ybthscwCqT-dlh%2Flog.txt?alt=media&token=c1ae95cc-5177-4b78-8a93-2fd4f2f3aea1) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqqu8wLZ6-hRXzwPsp%2F-MSqw6ybthscwCqT-dlh%2Flog.txt?alt=media&token=c1ae95cc-5177-4b78-8a93-2fd4f2f3aea1) #009 log file-download 5KB [tegra30-microsoft-surfaceRT.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqqu8wLZ6-hRXzwPsp%2F-MSqwB2y4iSm_TPPuuWH%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=4bb13676-a1dd-425d-9add-d6f2df449b1a) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqqu8wLZ6-hRXzwPsp%2F-MSqwB2y4iSm_TPPuuWH%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=4bb13676-a1dd-425d-9add-d6f2df449b1a) #009 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-010) #010 Only device tree edits. Screen still doesn't work. Boots fine to Buildroot. Log has commands at the bottom. file-download 155KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqwMas9zQY4r-BC1Cc%2F-MSr-LgUsORyVXIfxwYt%2F.config?alt=media&token=e44c10e4-5244-4efa-9d05-efbcea60084e) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqwMas9zQY4r-BC1Cc%2F-MSr-LgUsORyVXIfxwYt%2F.config?alt=media&token=e44c10e4-5244-4efa-9d05-efbcea60084e) #010 .config file-download 19KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqwMas9zQY4r-BC1Cc%2F-MSr-SztRYpqxtuWNcRG%2Flog.txt?alt=media&token=8398305e-f1e5-4a82-8a02-0226cc8b3a24) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqwMas9zQY4r-BC1Cc%2F-MSr-SztRYpqxtuWNcRG%2Flog.txt?alt=media&token=8398305e-f1e5-4a82-8a02-0226cc8b3a24) #010 log file-download 6KB [tegra30-microsoft-surfaceRT.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqwMas9zQY4r-BC1Cc%2F-MSr-aheRIinLOq_9BoM%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=4b5ebfb4-a45c-4ec1-ba46-d5e920dd0e0b) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSqwMas9zQY4r-BC1Cc%2F-MSr-aheRIinLOq_9BoM%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=4b5ebfb4-a45c-4ec1-ba46-d5e920dd0e0b) #010 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-011) #011 `CONFIG_CMDLINE="console=ttyS0,115200 console=tty0 earlyprintk initcall_debug sched_debug lpj=10000"` Found out that screen works, but it gets cleared when Busybox (from ramdisk) starts. At least I think at that point it gets cleared, not 100% sure. file-download 155KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSr-kAjWjB5Jzr9CTdK%2F-MSrHroYfxk5LUazg_MW%2F.config?alt=media&token=ad7efa98-9fa8-4b99-ba5f-70d122a002ed) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSr-kAjWjB5Jzr9CTdK%2F-MSrHroYfxk5LUazg_MW%2F.config?alt=media&token=ad7efa98-9fa8-4b99-ba5f-70d122a002ed) #011 .config file-download 22KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSr-kAjWjB5Jzr9CTdK%2F-MSrI37EnJTmen8PUJ5P%2Flog.txt?alt=media&token=7b2d4fbc-753b-46ea-be74-c4878e90150b) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSr-kAjWjB5Jzr9CTdK%2F-MSrI37EnJTmen8PUJ5P%2Flog.txt?alt=media&token=7b2d4fbc-753b-46ea-be74-c4878e90150b) #011 log file-download 6KB [tegra30-microsoft-surfaceRT.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSr-kAjWjB5Jzr9CTdK%2F-MSrI6tUDBiAQDt7IsKw%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=d276fc01-daf6-4e48-b301-f1560e8bbe67) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSr-kAjWjB5Jzr9CTdK%2F-MSrI6tUDBiAQDt7IsKw%2Ftegra30-microsoft-surfaceRT.dts?alt=media&token=d276fc01-daf6-4e48-b301-f1560e8bbe67) #011 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-012) #012 `CONFIG_CMDLINE="console=ttyS0,115200 earlyprintk initcall_debug sched_debug lpj=10000"` Minimal device tree with sd-card+emmc+uart, it includes tegra30.dtsi No display output with this command line, but you get log output when adding `console=tty0`, but afterwards it stops around when Busybox takes over. file-download 155KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSrIBpz38vXld9pTyNA%2F-MSsD1azqcxbYAuMqLDf%2F.config?alt=media&token=bf0504dc-7648-4da6-a5de-599cae1a4e52) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSrIBpz38vXld9pTyNA%2F-MSsD1azqcxbYAuMqLDf%2F.config?alt=media&token=bf0504dc-7648-4da6-a5de-599cae1a4e52) #012 .config file-download 25KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSrIBpz38vXld9pTyNA%2F-MSsDDe5qPbVx_Q07Mai%2Flog.txt?alt=media&token=24558f59-516a-43e7-af14-70ca10684b55) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSrIBpz38vXld9pTyNA%2F-MSsDDe5qPbVx_Q07Mai%2Flog.txt?alt=media&token=24558f59-516a-43e7-af14-70ca10684b55) #012 log file-download 932B [tegra30-microsoft-surfaceRT-test2.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSrIBpz38vXld9pTyNA%2F-MSsDJgTTEKK_YUoB9aB%2Ftegra30-microsoft-surfaceRT-test2.dts?alt=media&token=56a779a1-0042-4888-bd25-301fe4bc1e40) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSrIBpz38vXld9pTyNA%2F-MSsDJgTTEKK_YUoB9aB%2Ftegra30-microsoft-surfaceRT-test2.dts?alt=media&token=56a779a1-0042-4888-bd25-301fe4bc1e40) #012 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-013) #013 Added a raspberry pi rootfs. Specifying root= option with efi shell Display stops working after the line `[ 251.431349] tegra-devfreq 6000c800.actmon: Failed to get emc clock` Log contains output from rootfs. file-download 155KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSsENz7M-ng3fylFvQu%2F-MSsZnhDIpRTkKVwO-6j%2F.config?alt=media&token=8f659cf8-dbb1-4591-8660-124c43cfe472) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSsENz7M-ng3fylFvQu%2F-MSsZnhDIpRTkKVwO-6j%2F.config?alt=media&token=8f659cf8-dbb1-4591-8660-124c43cfe472) #013 .config file-download 29KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSsENz7M-ng3fylFvQu%2F-MSsZrNQU2N5X22cLsYV%2Flog.txt?alt=media&token=d7149e44-ac90-4489-995a-3b7e5dc9c4dc) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSsENz7M-ng3fylFvQu%2F-MSsZrNQU2N5X22cLsYV%2Flog.txt?alt=media&token=d7149e44-ac90-4489-995a-3b7e5dc9c4dc) #013 log file-download 932B [tegra30-microsoft-surfaceRT-test2.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSsENz7M-ng3fylFvQu%2F-MSsZw9wbu92rQBi_5GX%2Ftegra30-microsoft-surfaceRT-test2.dts?alt=media&token=39a534a3-fbe1-4e0b-aa41-705c3a7e0f0c) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSsENz7M-ng3fylFvQu%2F-MSsZw9wbu92rQBi_5GX%2Ftegra30-microsoft-surfaceRT-test2.dts?alt=media&token=39a534a3-fbe1-4e0b-aa41-705c3a7e0f0c) #013 device tree circle-info Config reseted. Started from a new one. #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-014) #014 `CONFIG_EFI_STUB=y CONFIG_EFI=y CONFIG_CMDLINE="console=ttyS0,115200n8 earlyprintk initcall_debug sched_debug lpj=10000 boot_delay=50" CONFIG_CMDLINE_EXTEND=y CONFIG_SMP=n CONFIG_CACHE_L2X0=n CONFIG_EARLY_PRINTK=y CONFIG_DEBUG_TEGRA_UART=y CONFIG_TEGRA_DEBUG_UARTA=y CONFIG_BOOT_PRINTK_DELAY=y` `CONFIG_BOOT_PRINTK_DELAY=y` and `boot_delay=50(cmdline)` are necessary so mmc driver gets loaded early enough. Log contains a few commands from rootfs. file-download 166KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSs_4bOAhLfk-YEaQ39%2F-MSsfPKUEQnjStb9m_HY%2F.config?alt=media&token=d1fa3bd1-e634-4217-8a7c-ef931b4f0646) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSs_4bOAhLfk-YEaQ39%2F-MSsfPKUEQnjStb9m_HY%2F.config?alt=media&token=d1fa3bd1-e634-4217-8a7c-ef931b4f0646) #014 .config file-download 36KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSs_4bOAhLfk-YEaQ39%2F-MSsfT8sRjaLgOY3Wgur%2Flog.txt?alt=media&token=35632e43-3632-4998-987b-851730b48b6d) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSs_4bOAhLfk-YEaQ39%2F-MSsfT8sRjaLgOY3Wgur%2Flog.txt?alt=media&token=35632e43-3632-4998-987b-851730b48b6d) #014 log file-download 932B [tegra30-microsoft-surfaceRT-test2.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSs_4bOAhLfk-YEaQ39%2F-MSsfWzYMRcdH0FIM7ox%2Ftegra30-microsoft-surfaceRT-test2.dts?alt=media&token=2bb5c646-9994-41ae-8940-2458b453e13a) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MSs_4bOAhLfk-YEaQ39%2F-MSsfWzYMRcdH0FIM7ox%2Ftegra30-microsoft-surfaceRT-test2.dts?alt=media&token=2bb5c646-9994-41ae-8940-2458b453e13a) #014 device tree #### [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#id-015) #015 I'm not sure what changed. Working display with booted raspberry pi os! ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MT0Kdl31nmBu746PDCW%252F-MT0ZgF041J6PkY6Lygp%252FIMG_20210208_131108.jpg%3Falt%3Dmedia%26token%3Dca125967-bbbb-4b8f-b8da-a90f327a3108&width=768&dpr=3&quality=100&sign=a66546cf&sv=2) file-download 166KB [.config](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MT0Kdl31nmBu746PDCW%2F-MT0bDIXoMmurzTKUi8Q%2F.config?alt=media&token=1bea3b45-a631-4914-8471-4e0c93ae3ede) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MT0Kdl31nmBu746PDCW%2F-MT0bDIXoMmurzTKUi8Q%2F.config?alt=media&token=1bea3b45-a631-4914-8471-4e0c93ae3ede) #015 .config file-download 47KB [log.txt](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MT0Kdl31nmBu746PDCW%2F-MT0bJYR1HQiLKPwBMHz%2Flog.txt?alt=media&token=9f0cd682-0ee7-4c8c-bc8f-104b06631ebe) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MT0Kdl31nmBu746PDCW%2F-MT0bJYR1HQiLKPwBMHz%2Flog.txt?alt=media&token=9f0cd682-0ee7-4c8c-bc8f-104b06631ebe) #015 log file-download 6KB [tegra30-microsoft-surfaceRT-test1.dts](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MT0bS-9GJka1YhlZFlI%2F-MT0tVomsu2kUyLp73oi%2Ftegra30-microsoft-surfaceRT-test1.dts?alt=media&token=59f083f4-5611-4d08-b375-1fa138cb0e08) downloadDownload[arrow-up-right-from-squareOpen](https://2395005476-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJQb34R_xPz0ll0scbM%2F-MT0bS-9GJka1YhlZFlI%2F-MT0tVomsu2kUyLp73oi%2Ftegra30-microsoft-surfaceRT-test1.dts?alt=media&token=59f083f4-5611-4d08-b375-1fa138cb0e08) #015 device tree [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#surface-rt-2) Surface RT 2 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- [PreviousEFI linux bootingchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting) [NextQemu emulationchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/qemu-emulation) Last updated 5 years ago Was this helpful? * [Surface RT 1](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#surface-rt-1) * [@Leander's trial and fail](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#leanders-trial-and-fail) * [Surface RT 2](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting/configs-we-already-tried#surface-rt-2) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # GRUB2 Booting Notes | Open Surface RT circle-check [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/grub2-booting-notes#booting-linux-with-grub-is-now-possible.-but-uefi-shell-is-normally-used) Booting Linux with grub is now possible. (But UEFI shell is normally used) --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Starting from Linux Kernel 5.0, it is now possible to enable FrameBuffer. This can be configured in grub with grub\_cfg Copy set grub_mm_debug=1 insmod efi_gop insmod efi_uga earlycon=efifb,mem More here - [https://forum.xda-developers.com/windows-8-rt/rt-development/wip-secure-boot-linux-surface-rt-t3653848/page13arrow-up-right](https://forum.xda-developers.com/windows-8-rt/rt-development/wip-secure-boot-linux-surface-rt-t3653848/page13) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/grub2-booting-notes#efistub-kernel-booting) EFISTUB (Kernel booting) ----------------------------------------------------------------------------------------------------------------------------------------------------- triangle-exclamation The information bellow is outdated. Visit [EFI linux booting](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-linux-booting) for information on how to compile & boot a working linux kernel. ![](https://open-rt.gitbook.io/open-surfacert/~gitbook/image?url=https%3A%2F%2F2395005476-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-legacy-files%2Fo%2Fassets%252F-MJQb34R_xPz0ll0scbM%252F-MJR_YYSXk3AA08S3H0y%252F-MJRaKta8swjlwnFGbVe%252Fimage.png%3Falt%3Dmedia%26token%3D89c9f689-38fa-455e-8d44-e2cf5bf40146&width=768&dpr=3&quality=100&sign=e7b27f70&sv=2) As we are "stuck" inside Microsofts bootarm.efi -> ContextSwitcher -> grub. [PreviousEFI Signing / Secure Bootchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/leander-devnotes/efi-signing-secure-boot) [NextCross Compilingchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/untitled) Last updated 4 years ago Was this helpful? Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon --- # !TODO | Open Surface RT [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#srt-and-s2) sRT & s2 --------------------------------------------------------------------------------------------------------------------------- * Bluetooth firmware * Ram timings * Some sensor drivers (hinge) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#tcover) TCOVER --------------------------------------------------------------------------------------------------------------------- * check tCover APX * ~Does N0 power the tCover??~ * explain WDSA table * check check how flipping back tCover brings up screenKeyboard; A: Sensor Collection/Hub [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#audio) AUDIO ------------------------------------------------------------------------------------------------------------------- * Headset Mic (Bias + right input) * Digital Stereo Mic (right gpio combination) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#sensor-collection) SENSOR COLLECTION ------------------------------------------------------------------------------------------------------------------------------------------- * check 0x28 power resource * check learn about the sensor collection (0x28) [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#uefi-stub) UEFI STUB --------------------------------------------------------------------------------------------------------------------------- * use appended devicetree if no dtb= param is provided [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#distro-installer) distro installer ----------------------------------------------------------------------------------------------------------------------------------------- * small buildroot which can format eMMC and download/install distros [hashtag](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#after-everything-is-done) after everything is done --------------------------------------------------------------------------------------------------------------------------------------------------------- * rip out dead mainboard and put raspi in. * case mod with some glass and RGB LEDs (+300MHz) @jwa4 * USB Type-C mod with PowerDelivery. Charging, data and maybe video out @LeYuuki * port downstream kernel * make bugles gpu 3d hardware acceleration driver @Leander [Previousinitrdchevron-left](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/initrd) [NextSurface RTchevron-right](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts/surface-rt) Last updated 4 years ago Was this helpful? * [sRT & s2](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#srt-and-s2) * [TCOVER](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#tcover) * [AUDIO](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#audio) * [SENSOR COLLECTION](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#sensor-collection) * [UEFI STUB](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#uefi-stub) * [distro installer](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#distro-installer) * [after everything is done](https://open-rt.gitbook.io/open-surfacert/development/please-read/cts-devnotes/todo-cts#after-everything-is-done) Was this helpful? sun-brightdesktopmoon sun-brightdesktopmoon ---