IBM HDAPS Someone interested?

IBM HDAPS Someone interested?

[Alejandro Bonilla]

Hi,

	As I have asked before, I will do it again. Sorry if this is not the right
place.

I'm looking for someone, a hope, anything from anyone that have an IBM T40,
T41, T42 or whoever has the Embedded "Airbag" solution in their Linux
Laptops.

The Hard Drive Active Protection System, which is in the IBM laptops (and
maybe some others) uses an Analog ADXL320 (or ADXL202) with the
accelerometer for XY to monitor the movement in the laptops.

We have the Datasheet, Application notes and free "Tech support" from Analog
Devices. Now, we need some developers interested in getting this to work. We
just need someone to start something or to take a couple of minutes to see
if this is doable, and if a linux driver came be made to make it work.

(There is also a Fingerprint reader that I would like to get working, but
that is somehow screwed up by security layers) :)

PLEASE, if you have a couple of minutes, or if you are interested in getting
this working, Please let me/us know.

http://www.analog.com/en/prod/0,2877,ADXL320,00.html

http://www.analog.com/en/prodRes/0,2889,ADXL202%255F871,00.html


Thanks for the time.

.Alejandro

Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Mon, Jun 20, 2005 at 09:18:08AM -0600, Alejandro Bonilla wrote:
> Hi,
> 
> 	As I have asked before, I will do it again. Sorry if this is not the right
> place.
> 
> I'm looking for someone, a hope, anything from anyone that have an IBM T40,
> T41, T42 or whoever has the Embedded "Airbag" solution in their Linux
> Laptops.
> 
> The Hard Drive Active Protection System, which is in the IBM laptops (and
> maybe some others) uses an Analog ADXL320 (or ADXL202) with the
> accelerometer for XY to monitor the movement in the laptops.
> 
> We have the Datasheet, Application notes and free "Tech support" from Analog
> Devices. Now, we need some developers interested in getting this to work. We
> just need someone to start something or to take a couple of minutes to see
> if this is doable, and if a linux driver came be made to make it work.
> 
> (There is also a Fingerprint reader that I would like to get working, but
> that is somehow screwed up by security layers) :)
> 
> PLEASE, if you have a couple of minutes, or if you are interested in getting
> this working, Please let me/us know.
> 
> http://www.analog.com/en/prod/0,2877,ADXL320,00.html
> 
> http://www.analog.com/en/prodRes/0,2889,ADXL202%255F871,00.html

I already have the documentation for the chips for my robotics projects,
I even have the chips. I'll have an Airbag-equipped IBM notebook soon,
hopefully, too.

However, this is not enough at all to write the driver. The
accelerometer is a trivial analog component (ok, not so trivial, but
still just analog), and the main question is how it is connected to the
PC.

Until IBM says something about that, or somebody reverse engineers their
BIOS/Windows drivers/whatever, a driver can't be written.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

RE: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> > I'm looking for someone, a hope, anything from anyone that
> have an IBM T40,
> > T41, T42 or whoever has the Embedded "Airbag" solution in
> their Linux
> > Laptops.
> >
> > The Hard Drive Active Protection System, which is in the
> IBM laptops (and
> > maybe some others) uses an Analog ADXL320 (or ADXL202) with the
> > accelerometer for XY to monitor the movement in the laptops.
>
> I already have the documentation for the chips for my
> robotics projects,
> I even have the chips. I'll have an Airbag-equipped IBM notebook soon,
> hopefully, too.
>
> However, this is not enough at all to write the driver. The
> accelerometer is a trivial analog component (ok, not so trivial, but
> still just analog), and the main question is how it is
> connected to the
> PC.
>
> Until IBM says something about that, or somebody reverse
> engineers their
> BIOS/Windows drivers/whatever, a driver can't be written.
>
> --
> Vojtech Pavlik
> SuSE Labs, SuSE CR

I was told, that the only thing that was needed was an ADD card. ( Analog to
Digital?)

If you are interested, I can call you and then conference Analog Devices,
and they will tell you what is needed, I bet IBM did whatever Analog Devices
told them to do. And they might even tell us what to do if they talk with
someone that knows (I was bumbling, while he was talking about all the IO
and G rates)

I don't think they have anything in the BIOS related to the HDAPS, else they
would have put something in it. (You can't even disable the chip in the
BIOS) I just think is the accelerometer, there, by itself with an extra card
they added.

.Alejandro

Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Mon, Jun 20, 2005 at 10:16:09AM -0600, Alejandro Bonilla wrote:

> I was told, that the only thing that was needed was an ADD card. ( Analog to
> Digital?)

Indeed, but there is a zillion of different approaches to an A/D.
I'm quite sure IBM have rolled their own directly on the mainboard.

The main question is on which bus and which address it lives and what is
the programming interface. It's not something Analog Devices would know.

It can be on some monitoring chip living on the SMBus (most likely) or
coupled directly to the ACPI bridge on PCI, or anywhere else in the
system.

> If you are interested, I can call you and then conference Analog Devices,
> and they will tell you what is needed, I bet IBM did whatever Analog Devices
> told them to do. And they might even tell us what to do if they talk with
> someone that knows (I was bumbling, while he was talking about all the IO
> and G rates)

Well, I will not be interested until I'm convinced they'll be able to
tell me something I don't know already.

> I don't think they have anything in the BIOS related to the HDAPS, else they
> would have put something in it. (You can't even disable the chip in the
> BIOS) I just think is the accelerometer, there, by itself with an extra card
> they added.
 
Well, some piece of software needs to park the HDD when the notebook is
falling, and that piece of software should better be running since the
notebook is powered on. Hence my suspicion it's in the BIOS. It doesn't
have to be visible to the user, at all.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

RE: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> On Mon, Jun 20, 2005 at 10:16:09AM -0600, Alejandro Bonilla wrote:
>
> > I was told, that the only thing that was needed was an ADD
> card. ( Analog to
> > Digital?)
>
> Indeed, but there is a zillion of different approaches to an A/D.
> I'm quite sure IBM have rolled their own directly on the mainboard.
>
> The main question is on which bus and which address it lives
> and what is
> the programming interface. It's not something Analog Devices
> would know.
>
> It can be on some monitoring chip living on the SMBus (most likely) or
> coupled directly to the ACPI bridge on PCI, or anywhere else in the
> system.
>
> > If you are interested, I can call you and then conference
> Analog Devices,
> > and they will tell you what is needed, I bet IBM did
> whatever Analog Devices
> > told them to do. And they might even tell us what to do if
> they talk with
> > someone that knows (I was bumbling, while he was talking
> about all the IO
> > and G rates)
>
> Well, I will not be interested until I'm convinced they'll be able to
> tell me something I don't know already.

I bet they will. They don't document it all, and I'm pretty sure that if you
ask the right question, then they will tell you what you are looking for.
After all, they should be our first step before trying anything.

I it obvious to me that they have at least tried once, to play with the IBM
mechanism.

They could have an aswer for us right now and tell us things that could make
things really easy.

After all, you won't pay for the phone call. ;-)

.Alejandro

>
> > I don't think they have anything in the BIOS related to the
> HDAPS, else they
> > would have put something in it. (You can't even disable the
> chip in the
> > BIOS) I just think is the accelerometer, there, by itself
> with an extra card
> > they added.
>
> Well, some piece of software needs to park the HDD when the
> notebook is
> falling, and that piece of software should better be running since the
> notebook is powered on. Hence my suspicion it's in the BIOS.
> It doesn't
> have to be visible to the user, at all.
>
> --
> Vojtech Pavlik
> SuSE Labs, SuSE CR

Re: IBM HDAPS Someone interested?

[Pavel Machek]

Hi!

> > I don't think they have anything in the BIOS related to the HDAPS, else they
> > would have put something in it. (You can't even disable the chip in the
> > BIOS) I just think is the accelerometer, there, by itself with an extra card
> > they added.
>  
> Well, some piece of software needs to park the HDD when the notebook is
> falling, and that piece of software should better be running since the
> notebook is powered on. Hence my suspicion it's in the BIOS. It doesn't
> have to be visible to the user, at all.

Actually yes, it needs to be visible to the user and no, it probably should not run during boot.
If user is in plane/train, accellerometers will basically detect problems all the time;
still you want to use the computer.
(And you still want the machine to boot => default == fall detection off).

IIRC there's windows program to control it.

-- 
64 bytes from 195.113.31.123: icmp_seq=28 ttl=51 time=448769.1 ms         

Re: [ltp] Re: IBM HDAPS Someone interested?

[Lenz Grimmer]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

let me add my 2 cents here, as I have been toying around with this idea,
too..

Vojtech Pavlik wrote:

> Indeed, but there is a zillion of different approaches to an A/D. I'm
> quite sure IBM have rolled their own directly on the mainboard.
> 
> The main question is on which bus and which address it lives and what
> is the programming interface. It's not something Analog Devices would
> know.
> 
> It can be on some monitoring chip living on the SMBus (most likely)
> or coupled directly to the ACPI bridge on PCI, or anywhere else in
> the system.

I tried monitoring the output of the embedded controller register dump
that the "ibm-acpi" kernel module provides, using the following command
and then moving the Laptop (Thinkpad T42) to trigger changes:

  watch -n1 cat /proc/acpi/ibm/ecdump

Alas, there wasn't really a pattern that convinced me that the chip
actually is monitored via this controller. But of course it may not harm
if somebody else double checks this.

> Well, some piece of software needs to park the HDD when the notebook
> is falling, and that piece of software should better be running since
> the notebook is powered on. Hence my suspicion it's in the BIOS. It
> doesn't have to be visible to the user, at all.

On Windows, you need to run a separate tray application that enables the
protection. So it seems like it's implemented in "userspace". It may be
worth debugging what this Window applet actually does...

Bye,
	LenZ
- --
- ------------------------------------------------------------------
 Lenz Grimmer <lenz@grimmer.com>                             -o)
 [ICQ: 160767607 | Jabber: LenZGr@jabber.org]                /\\
 http://www.lenzg.org/                                       V_V
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCtvciSVDhKrJykfIRAuhyAJ42vpQg/lnZiNVvskrHXtqaBxn9MQCeNfqO
HGrR0AmgZUR9gmn3S4biJsA=
=cOZT
-----END PGP SIGNATURE-----

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> I tried monitoring the output of the embedded controller register dump
> that the "ibm-acpi" kernel module provides, using the
> following command
> and then moving the Laptop (Thinkpad T42) to trigger changes:
>
>   watch -n1 cat /proc/acpi/ibm/ecdump
>
> Alas, there wasn't really a pattern that convinced me that the chip
> actually is monitored via this controller. But of course it
> may not harm
> if somebody else double checks this.
>
> > Well, some piece of software needs to park the HDD when the notebook
> > is falling, and that piece of software should better be
> running since
> > the notebook is powered on. Hence my suspicion it's in the BIOS. It
> > doesn't have to be visible to the user, at all.
>
> On Windows, you need to run a separate tray application that
> enables the
> protection. So it seems like it's implemented in "userspace".
> It may be
> worth debugging what this Window applet actually does...
>
> Bye,
> 	LenZ

Lenz,

	I will try this at home in about 4 hours and then let you know of the
output. This is really the first command that I can see that might give us
any/non information.

.Alejandro

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

>
> > Well, some piece of software needs to park the HDD when the
> notebook is
> > falling, and that piece of software should better be
> running since the
> > notebook is powered on. Hence my suspicion it's in the
> BIOS. It doesn't
> > have to be visible to the user, at all.
>
> No, the software, under Windows, is an application; you can control
> the behaviour of the disk based on the response of the chip.
>
> Anyway I don't think it's a simple task to create a driver for the
> accelerometer; one thing is to read the data from the chip (I suppose
> it's not too hard), but the most part of the job is to know what to do
> with the data you read.
>
> IBM developed a mathematical model that describes the typical usage of
> the ThinkPad, and they based the action on this math model. Developing
> a free math model is quite hard and also we cannot destroy 5 or 6 TP
> only to see how the signals are produced by the chip in all the
> possible situations (IBM instead can destroy as much TP as
> they want :(
>
> I think the only practical solution is to ask IBM to release a free
> driver for linux; maybe joining our forces we can achive some result.
>
> - --
> Flavio Visentin

What is normally done here in Linux? A mass of people starts sending emails
to IBM to ask for ANY support, or do we have contacts? I have already
contacted the Linux developers that created the Linux driver for the
security chip for the IBM's and they had no clue of what they can do?

If this is the case, and there is no normal way for IBM to release the spec
or driver, then we will need to send emails to IBM, asking for the Linux
support. After all, they claim that they are all into Linux (not all, but
they kind of like it)

What should we do? askibm@info.ibm.com ? Should we go into the Query page
and ask them there? https://www.ibm.com/contact/us/en/query

Lenovo has the PC stuff of IBM, but still, they are fully into it and
therefore will be able to know what they can do here. The support is given
by IBM, not lenovo, they just sell the computers.

????

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Pekka Enberg]

On 6/20/05, Lenz Grimmer <lenz@grimmer.com> wrote:
> On Windows, you need to run a separate tray application that enables the
> protection. So it seems like it's implemented in "userspace". It may be
> worth debugging what this Window applet actually does...

According to this [1], the mechanism can tell the difference between
harmful movements and repetitive motion which definitely suggests an
in driver (or userspace) statistics model based prediction.

P.S. I have a ThinkPad 41p or 42p at work. I am willing to help out if
it has the said device and we can get enough info on how to program
it.

                        Pekka

  1. http://www.anandtech.com/printarticle.aspx?i=1893

Re: [ltp] Re: IBM HDAPS Someone interested?

[Yani Ioannou]

Hi Alejandro,

You aren't the only one interested in a Linux active protection
driver, and unfortunately you aren't the first person to try to get
IBM/Lenevo to release the specs for the interface (the chip
documentation itself is useless without it). Lenevo has clearly stated
in the past that it will not open up the specifications and/or write
an open source Linux driver for it at the moment because they consider
it a competitive advantage, if you search back through the lm_sensors
or lkml archives (I can't remember which I saw it in) you will find
the statement.

I myself have tried to determine where it is interfaced from. I
checked ACPI and I2c/Smbus (I don't recommend the latter, although
experimenting with lm_sensors/i2cdump on a thinkpad is often fatal
I've been lucky on my T42p) but with no luck. I had come to the
conclusion myself that it is interfaced through the embedded
controller. Unfortunately the embedded controller is not that well
supported by Linux itself, except what is supported through the
thinkpad (and company) kernel modules, and Lenz seems to think this is
not the case anyway.

If anyone managed to work out how to interface to the sensors (there
is I believe two sensors, an accelerometer and gyroscope) then I might
be willing to help, although I'm sure I haven't got the agility to
drop my notebook and catch it a few hundred times ;-).

On 6/20/05, Alejandro Bonilla <abonilla@linuxwireless.org> wrote:
> >
> > > Well, some piece of software needs to park the HDD when the
> > notebook is
> > > falling, and that piece of software should better be
> > running since the
> > > notebook is powered on. Hence my suspicion it's in the
> > BIOS. It doesn't
> > > have to be visible to the user, at all.
> >
> > No, the software, under Windows, is an application; you can control
> > the behaviour of the disk based on the response of the chip.

Actually it is kind of both, notice when you are booting the thinkpad
pauses as it calibrates/initializes the sensor. If you are unlucky
enough to be on a bumpy train ride like I have been at times when
trying to boot the sensor subsystem can't calibrate/initialize and
won't let you boot. After that initial test though control seems to be
left to the userspace driver.

Yani

Re: [ltp] Re: IBM HDAPS Someone interested?

[Yani Ioannou]

On 6/20/05, Yani Ioannou <yani.ioannou@gmail.com> wrote:
> Hi Alejandro,
> 
> You aren't the only one interested in a Linux active protection
> driver, and unfortunately you aren't the first person to try to get
> IBM/Lenevo to release the specs for the interface (the chip
> documentation itself is useless without it). Lenevo has clearly stated
> in the past that it will not open up the specifications and/or write
> an open source Linux driver for it at the moment because they consider
> it a competitive advantage, if you search back through the lm_sensors
> or lkml archives (I can't remember which I saw it in) you will find
> the statement.

Ah..here it is:
http://lkml.org/lkml/2005/5/11/163

I guess you already know about that satement then ...err..nevermind :-).

Yani

Re: [ltp] Re: IBM HDAPS Someone interested?

[Andrew Haninger]

On 6/20/05, Pekka Enberg <penberg@gmail.com> wrote:
> P.S. I have a ThinkPad 41p or 42p at work. I am willing to help out if
> it has the said device and we can get enough info on how to program
> it.
FWIW, I have a Thinkpad t42 with APS. It's still running Windows XP so
I'm not sure how much help I can be here. I will keep an eye on this
thread in the case that I can be of any assistance later.

-Andy

Re: [ltp] Re: IBM HDAPS Someone interested?

[Pavel Machek]

Hi!

> > No, the software, under Windows, is an application; you can control
> > the behaviour of the disk based on the response of the chip.
> >
> > Anyway I don't think it's a simple task to create a driver for the
> > accelerometer; one thing is to read the data from the chip (I suppose
> > it's not too hard), but the most part of the job is to know what to do
> > with the data you read.
> >
> > IBM developed a mathematical model that describes the typical usage of
> > the ThinkPad, and they based the action on this math model. Developing
> > a free math model is quite hard and also we cannot destroy 5 or 6 TP
> > only to see how the signals are produced by the chip in all the
> > possible situations (IBM instead can destroy as much TP as
> > they want :(

You basically want to detect free fall. You don't need to make the machine
hit the concrete at the bottom; as long as it detects free fall, it is okay.
It does not seem *that* hard to me (but I do speech recognition at university :-).

Anyway, accelerometers are usefull for other stuff, too, like playing neverball.

Oh, and there should be reasonable way to develop this. First, detect
"machine sitting on unmoving table", and park heads if you detect anythink
else. Now, someone who really cares can develop model for "train", but most users are already quite well protected after you do "table" model.
				Pavel
-- 
64 bytes from 195.113.31.123: icmp_seq=28 ttl=51 time=448769.1 ms         

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> Ah..here it is:
> http://lkml.org/lkml/2005/5/11/163
>
> I guess you already know about that satement then
> ...err..nevermind :-).
>
> Yani

Yani,

	What company has ever released a Linux driver, just for the heck of it, or
simply because they wanted it out? Hell no.

(maybe a couple odd ones)

We have to be persistent and ask them to release something, we paid a lot of
money, and I have been missinformed to the fact that IBM loved Linux and
wanted to "support it". Looks like a big lie to me. They don't even need to
release a driver, just information. It is not even something that they only
have. Now we all know that Analog Devices makes the hardware. Not them.

So much for anything. I will keep asking for this information.

If people would send emails to IBM like I have, instead of complaining and
doing pilitical arguments, we probably would have an answer already.

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Yani Ioannou]

On 6/20/05, Alejandro Bonilla <abonilla@linuxwireless.org> wrote:
> Yani,
> 
>         What company has ever released a Linux driver, just for the heck of it, or
> simply because they wanted it out? Hell no.

Actually..a quick search through LKML and lm_sensors reveals quite a
few, but there could always be more.

> We have to be persistent and ask them to release something, we paid a lot of
> money, and I have been missinformed to the fact that IBM loved Linux and
> wanted to "support it". Looks like a big lie to me. They don't even need to
> release a driver, just information. It is not even something that they only
> have. Now we all know that Analog Devices makes the hardware. Not them.

Well, aside from this having nothing to do with IBM anymore, I agree
that I personally don't see the great harm in Lenevo releasing the
information. Many other notebook manufactuers have a similair system
now (Apple powerbooks, and some others) so the competitive advantage
is waning.

> If people would send emails to IBM like I have, instead of complaining and
> doing pilitical arguments, we probably would have an answer already.

I don't see how I did either of those :-|. I simply thought you hadn't
seen the statement, obviously you had. I also wanted to provide what I
thought was important feedback on what I had determined myself about
the system.

Yani

Re: IBM HDAPS Someone interested?

[Yani Ioannou]

> Actually yes, it needs to be visible to the user and no, it probably should not run during boot.
> If user is in plane/train, accellerometers will basically detect problems all the time;
> still you want to use the computer.

It does though :-) see my post.

Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Mon, Jun 20, 2005 at 06:57:04PM +0200, Pavel Machek wrote:
> Hi!
> 
> > > I don't think they have anything in the BIOS related to the HDAPS, else they
> > > would have put something in it. (You can't even disable the chip in the
> > > BIOS) I just think is the accelerometer, there, by itself with an extra card
> > > they added.
> >  
> > Well, some piece of software needs to park the HDD when the notebook is
> > falling, and that piece of software should better be running since the
> > notebook is powered on. Hence my suspicion it's in the BIOS. It doesn't
> > have to be visible to the user, at all.
> 
> Actually yes, it needs to be visible to the user and no, it probably
> should not run during boot.  If user is in plane/train,
> accellerometers will basically detect problems all the time; still you
> want to use the computer.

It likely won't. What it does is that it detects a situation with no
gravity - free fall.

> (And you still want the machine to boot => default == fall detection off).

It will boot. It may boot slower if you're jumping from an airplane at
the time, but it'll just park the heads now and then, which, with
IBM/Hitachi drives doesn't take long.

> IIRC there's windows program to control it.
 
That's likely. What good would a feature be for marketing if it wasn't
visible to the user. ;)

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

>
> I don't see how I did either of those :-|. I simply thought you hadn't
> seen the statement, obviously you had. I also wanted to provide what I
> thought was important feedback on what I had determined myself about
> the system.
>
> Yani
>

Yani,

	I apologize. I meant not to say this. I'm just frustrated that there are
all this hax0rs and shit, and still no one (even me ((no haxor)) don't know
anything about it.

	Again, I would appreciate any input about getting in touch to the hardware.
And if you can't do that, then we shall organize to ask IBM again, that us,
the Linux users, Want support for this feature, whatever it takes.

	I'm sometimes amazed by the fact that this OEM's simply send us to fuck
off, instead of providing more help or support. In IBM there are a lot of
Linux developers, even here in LKML. It would take them like 20 minutes to
make some sort of interface for this thing. BUT NO!

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Mon, Jun 20, 2005 at 02:25:52PM -0600, Alejandro Bonilla wrote:

> Yani,
> 
> 	What company has ever released a Linux driver, just for the heck
> 	of it, or simply because they wanted it out? Hell no.
> 
> (maybe a couple odd ones)
> 
> We have to be persistent and ask them to release something, we paid a
> lot of money, and I have been missinformed to the fact that IBM loved
> Linux and wanted to "support it". Looks like a big lie to me. They
> don't even need to release a driver, just information. It is not even
> something that they only have. Now we all know that Analog Devices
> makes the hardware. Not them.

Motorola makes similar sensors (MMA1220D, etc). The fact that the sensor
is from AD doesn't mean anything, unfortunately, it's a generic sensor
used in videocameras (picture stabilization), digital cameras (picture
orientation detection), joysticks (logitech wingman gamepad), and many
other devices.

It's IBM (Lenovo) who interfaced it to some kind of a A/D and a
processor inside the machine that detects the free fall condition and
informs the BIOS/OS about it.

> So much for anything. I will keep asking for this information.
> 
> If people would send emails to IBM like I have, instead of complaining and
> doing pilitical arguments, we probably would have an answer already.

I believe at this moment the best approach is to track where the
connections on the mainboard go from the accelerometer. ;)

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: IBM HDAPS Someone interested?

[Pavel Machek]

Hi!

> > > > I don't think they have anything in the BIOS related to the HDAPS, else they
> > > > would have put something in it. (You can't even disable the chip in the
> > > > BIOS) I just think is the accelerometer, there, by itself with an extra card
> > > > they added.
> > >  
> > > Well, some piece of software needs to park the HDD when the notebook is
> > > falling, and that piece of software should better be running since the
> > > notebook is powered on. Hence my suspicion it's in the BIOS. It doesn't
> > > have to be visible to the user, at all.
> > 
> > Actually yes, it needs to be visible to the user and no, it probably
> > should not run during boot.  If user is in plane/train,
> > accellerometers will basically detect problems all the time; still you
> > want to use the computer.
> 
> It likely won't. What it does is that it detects a situation with no
> gravity - free fall.

IIRC it is more complicated than that. Free fall is too late, laptop
usually fall from 1meter. Thats not enough time to park the
heads. Fortunately, laptop usually tilts before it falls off the table
-- and they are measuring the tilt before the fall. That buys them
enough time to actually do anything with it.

Story says, that they once had version that worked from 2meters+. It
was kind of useless, because no laptop ever fell from that height and
those that did were destroyed anyway.

[ s = a t ^ 2.
  s = ~1m.
  a = 9.8m*s^-2.

  t = sqrt( s/a )
  t = 
ucalc> (1 m / (9.8 * (m * sec ^ (-2)))) ^ 0.5
OK:  0.319438  sec

...ouch, it should be way faster, 0.3sec is definitely enough to park
heads.]

								Pavel
-- 
teflon -- maybe it is a trademark, but it should not be.

Re: IBM HDAPS Someone interested?

[Adam Goode]

[-- Attachment #1: Type: text/plain, Size: 2229 bytes --]

On Mon, 2005-06-20 at 22:45 +0200, Vojtech Pavlik wrote:
> On Mon, Jun 20, 2005 at 06:57:04PM +0200, Pavel Machek wrote:
> > Hi!
> > 
> > > > I don't think they have anything in the BIOS related to the HDAPS, else they
> > > > would have put something in it. (You can't even disable the chip in the
> > > > BIOS) I just think is the accelerometer, there, by itself with an extra card
> > > > they added.
> > >  
> > > Well, some piece of software needs to park the HDD when the notebook is
> > > falling, and that piece of software should better be running since the
> > > notebook is powered on. Hence my suspicion it's in the BIOS. It doesn't
> > > have to be visible to the user, at all.
> > 
> > Actually yes, it needs to be visible to the user and no, it probably
> > should not run during boot.  If user is in plane/train,
> > accellerometers will basically detect problems all the time; still you
> > want to use the computer.
> 
> It likely won't. What it does is that it detects a situation with no
> gravity - free fall.
> 
> > (And you still want the machine to boot => default == fall detection off).
> 
> It will boot. It may boot slower if you're jumping from an airplane at
> the time, but it'll just park the heads now and then, which, with
> IBM/Hitachi drives doesn't take long.
> 
> > IIRC there's windows program to control it.
>  
> That's likely. What good would a feature be for marketing if it wasn't
> visible to the user. ;)
> 


This paper tells about the "heuristic learning algorithm" used to park
the drives:

http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53432

It seems that by IBM's calculations, desk-to-floor distance is
insufficient time to detect freefall and park the heads. So they
actually park the heads when it detects "starting to slide off table"...

Freefall detection: 300 ms
Head park time: 300-500 ms
  (from page 2 of document)

Still doesn't seem too bad to figure out how to code though, at least
once we can figure out how to get the data stream!

P.S. The main control system runs as a Windows kernel driver. Not as
safe as full hardware, but probably better than userspace. :)


Thanks,

Adam


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

RE: [ltp] Re: IBM HDAPS Someone interested?

[Lee Revell]

On Mon, 2005-06-20 at 14:48 -0600, Alejandro Bonilla wrote:
> It would take them like 20 minutes to
> make some sort of interface for this thing. BUT NO! 

Sounds like it would also take 20 minutes to RE, has anyone even tried?

Lee

Re: IBM HDAPS Someone interested?

[Pavel Machek]

Hi!

Apple connects their accelerometer over i2c, see:

http://www.kernelthread.com/software/ams/

For some reverse engineering attempts, see:

http://www.paul.sladen.org/thinkpad-r31/accelerometer.html

According to IBM, it is *not* enabled during system bootup:

http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53167

According to another text, BIOS know how to test accelerometer in some
kind of self test. Aha, here's the most interesting text:

http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53432

According to this text:

typical free-fall takes 300msec, but head unloading takes
300-500msec. [So I had my computation right ;-)] ... "therefore, it is
too late to start head unloading after detecting free fall"...

They really try to detect conditions just before free fall... and it
does not sound that difficult.

Another clever trick is that if user is still using the mouse, machine
is probably not in free fall ;-). In pdf, they also mention few
.sys files. They should probably be disassembled to learn how the
interface works (hint hint), actually exported symbol names should be
quite helpfull in determining what function is the interesting one. 

								Pavel
-- 
teflon -- maybe it is a trademark, but it should not be.

Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

Pavel Machek wrote:

>Hi!
>
>Apple connects their accelerometer over i2c, see:
>
>http://www.kernelthread.com/software/ams/
>
>For some reverse engineering attempts, see:
>
>http://www.paul.sladen.org/thinkpad-r31/accelerometer.html
>
>According to IBM, it is *not* enabled during system bootup:
>
>http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53167
>
>According to another text, BIOS know how to test accelerometer in some
>kind of self test. Aha, here's the most interesting text:
>
>http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53432
>
>According to this text:
>
>typical free-fall takes 300msec, but head unloading takes
>300-500msec. [So I had my computation right ;-)] ... "therefore, it is
>too late to start head unloading after detecting free fall"...
>
>They really try to detect conditions just before free fall... and it
>does not sound that difficult.
>
>Another clever trick is that if user is still using the mouse, machine
>is probably not in free fall ;-). In pdf, they also mention few
>.sys files. They should probably be disassembled to learn how the
>interface works (hint hint), actually exported symbol names should be
>quite helpfull in determining what function is the interesting one. 
>
>								Pavel
>  
>
Pavel,

    Thanks for all this information and to everyone providing data. This 
is really want we want. But We need to know how to talk to the chip 
before getting any on these math results to work.

Try what Lenz said: watch -n1 cat /proc/acpi/ibm/ecdump

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

Lenz Grimmer,

I'm trying to do watch -n1 cat /proc/acpi/ibm/ecdump, But I don't have 
ecdump. I'm with ibm-acpi 0.8

Any idea?

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Lee Revell]

1On Mon, 2005-06-20 at 16:57 -0500, Alejandro Bonilla wrote:
> Lenz Grimmer,
> 
> I'm trying to do watch -n1 cat /proc/acpi/ibm/ecdump, But I don't have 
> ecdump. I'm with ibm-acpi 0.8
> 

I was thinking more along the lines of figure out the io port it's
using, then boot windows, set an IO breakpoint in softice, then drop
your laptop on the bed or something.

Lee

Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

Alejandro Bonilla wrote:

> Pavel Machek wrote:
>
>> Hi!
>>
>> Apple connects their accelerometer over i2c, see:
>>
>> http://www.kernelthread.com/software/ams/
>>
>> For some reverse engineering attempts, see:
>>
>> http://www.paul.sladen.org/thinkpad-r31/accelerometer.html
>>
>> According to IBM, it is *not* enabled during system bootup:
>>
>> http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53167 
>>
>>
>> According to another text, BIOS know how to test accelerometer in some
>> kind of self test. Aha, here's the most interesting text:
>>
>> http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-53432 
>>
>>
>> According to this text:
>>
>> typical free-fall takes 300msec, but head unloading takes
>> 300-500msec. [So I had my computation right ;-)] ... "therefore, it is
>> too late to start head unloading after detecting free fall"...
>>
>> They really try to detect conditions just before free fall... and it
>> does not sound that difficult.
>>
>> Another clever trick is that if user is still using the mouse, machine
>> is probably not in free fall ;-). In pdf, they also mention few
>> .sys files. They should probably be disassembled to learn how the
>> interface works (hint hint), actually exported symbol names should be
>> quite helpfull in determining what function is the interesting one.
>>                                 Pavel
>>  
>>
Boris,

    Do you know anything about the HD APS? Is it linked to the embedded 
controller?

.Alejandro

Re: IBM HDAPS Someone interested?

[Lee Revell]

On Mon, 2005-06-20 at 17:30 -0400, Adam Goode wrote:
> Freefall detection: 300 ms
> Head park time: 300-500 ms
>   (from page 2 of document)
> 
> Still doesn't seem too bad to figure out how to code though, at least
> once we can figure out how to get the data stream!
> 
> P.S. The main control system runs as a Windows kernel driver. Not as
> safe as full hardware, but probably better than userspace. :)
> 

Ugh, if userspace can't meet a 300ms RT constraint, that's a pretty
shitty OS you have there.

This should certainly be done in userspace on Linux.

Lee

Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Tue, Jun 21, 2005 at 11:37:38AM -0400, Lee Revell wrote:

> On Mon, 2005-06-20 at 17:30 -0400, Adam Goode wrote:
> > Freefall detection: 300 ms
> > Head park time: 300-500 ms
> >   (from page 2 of document)
> > 
> > Still doesn't seem too bad to figure out how to code though, at least
> > once we can figure out how to get the data stream!
> > 
> > P.S. The main control system runs as a Windows kernel driver. Not as
> > safe as full hardware, but probably better than userspace. :)
> > 
> 
> Ugh, if userspace can't meet a 300ms RT constraint, that's a pretty
> shitty OS you have there.

It's not that you do one measurement in the 300ms. You need to do at least
100, and some computations, too.

> This should certainly be done in userspace on Linux.

So it's a 3ms RT constraint, which is not as easy.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: IBM HDAPS Someone interested?

[Lee Revell]

On Tue, 2005-06-21 at 18:45 +0200, Vojtech Pavlik wrote:
> On Tue, Jun 21, 2005 at 11:37:38AM -0400, Lee Revell wrote:
> > Ugh, if userspace can't meet a 300ms RT constraint, that's a pretty
> > shitty OS you have there.
> 
> It's not that you do one measurement in the 300ms. You need to do at least
> 100, and some computations, too.
> 
> > This should certainly be done in userspace on Linux.
> 
> So it's a 3ms RT constraint, which is not as easy.
> 

Heh, we do it all the time with JACK.

But, I think I was wrong anyway, you'll have to do it in the kernel
because you would need PREEMPT to meet that with any degree of
certainty.

Lee

Re: IBM HDAPS Someone interested?

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 579 bytes --]

On Tue, 21 Jun 2005 11:37:38 EDT, Lee Revell said:
> On Mon, 2005-06-20 at 17:30 -0400, Adam Goode wrote:
> > Freefall detection: 300 ms
> > Head park time: 300-500 ms

> Ugh, if userspace can't meet a 300ms RT constraint, that's a pretty
> shitty OS you have there.

Actually, it's a lot tighter than that.  You need to *issue* the "park head"
command 300-500ms before it hits the ground, and you have 300ms of free fall.

So you may have needed to detect the free fall and issue the command 200ms
before the free fall commences.

That's a *real* hard RT constraint to keep. ;)

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]

Re: [ltp] Re: IBM HDAPS Someone interested?

[Pavel Machek]

Hi!

> > I'm trying to do watch -n1 cat /proc/acpi/ibm/ecdump, But I don't have 
> > ecdump. I'm with ibm-acpi 0.8
> > 
> 
> I was thinking more along the lines of figure out the io port it's
> using, then boot windows, set an IO breakpoint in softice, then drop
> your laptop on the bed or something.

It should be enough to tilt your laptop so that it parks heads... safer than
dropping it.

And perhaps easier solution is to locate the sensor on the mainboard, and
trace where it is connected with magnifying glass (as vojtech already suggested).

				Pavel

-- 
64 bytes from 195.113.31.123: icmp_seq=28 ttl=51 time=448769.1 ms         

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> Hi!
>
> > > I'm trying to do watch -n1 cat /proc/acpi/ibm/ecdump, But
> I don't have
> > > ecdump. I'm with ibm-acpi 0.8
> > >
> >
> > I was thinking more along the lines of figure out the io port it's
> > using, then boot windows, set an IO breakpoint in softice, then drop
> > your laptop on the bed or something.
>
> It should be enough to tilt your laptop so that it parks
> heads... safer than
> dropping it.
>
> And perhaps easier solution is to locate the sensor on the
> mainboard, and
> trace where it is connected with magnifying glass (as vojtech
> already suggested).
>
> 				Pavel
>
> --
> 64 bytes from 195.113.31.123: icmp_seq=28 ttl=51
> time=448769.1 ms
>

/proc/acpi/ibm/ecdump is really not providing any information about this
sensor. yesterday, I almost broke the laptop to see if it would generate
anything, but it really only outputs ACPI events...

I shaked it, moved it 90deg and still no result, threw the lappy from like
40cm to the bed and nothing was really generated. Unless it is too fast like
to generate it in the watch or to be seen by human eye. I dunno.

It looks like /ecdump won't do it.

.Alejandro

Re: IBM HDAPS Someone interested?

[Sander]

Valdis.Kletnieks@vt.edu wrote (ao):
> On Tue, 21 Jun 2005 11:37:38 EDT, Lee Revell said:
> > On Mon, 2005-06-20 at 17:30 -0400, Adam Goode wrote:
> > > Freefall detection: 300 ms
> > > Head park time: 300-500 ms
> 
> > Ugh, if userspace can't meet a 300ms RT constraint, that's a pretty
> > shitty OS you have there.
> 
> Actually, it's a lot tighter than that. You need to *issue* the "park
> head" command 300-500ms before it hits the ground, and you have 300ms
> of free fall.
> 
> So you may have needed to detect the free fall and issue the command
> 200ms before the free fall commences.
> 
> That's a *real* hard RT constraint to keep. ;)

FWIW. I have a X40 and am still running windows. The harddisk protection
software has an icon in the windows bar near the clock which shows if
the disk is 'not parked', 'parked due to movement of the notebook', or
'not parked, but a steady stream of possible harmless shocks is
noticed'.

The software reacts very quick and is very sensitive. The slightest
movement of the notebook makes the disk park its heads instantly (very,
very quick) for a moment with a fairly loud click. Even if you just
slide the notebook a centimeter over the table or tilt it a little. The
software also has a realtime '3D' image of the notebook which show the
tilting of the notebook. Pretty neat.

I once tripped over the network cable and had the notebook fly through
the air and eventually hit the floor. The harddisk was still fine (as
was the rest of the notebook which impressed me because the lid was in a
180 degree angle with the keyboard after it hit the floor).

Please let me know if I can be of any help running windows or linux.

        With kind regards, Sander

RE: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> little. The
> software also has a realtime '3D' image of the notebook which show the
> tilting of the notebook. Pretty neat.
>
> I once tripped over the network cable and had the notebook fly through
> the air and eventually hit the floor. The harddisk was still fine (as
> was the rest of the notebook which impressed me because the
> lid was in a
> 180 degree angle with the keyboard after it hit the floor).
>
> Please let me know if I can be of any help running windows or linux.
>
>         With kind regards, Sander

Sander,

	This is exactly what we want here. Once we have information on how to
access the device, we will be able to create all these nice features, that
for example, will help people that had your same problem. Imagine that just
because someone tripped over the cable, you will loose your HD, data,
backup, Music and so on. And the worst thing, your laptop has the feature,
but you can't use it. I was also looking into making the 3D show, but,
nothing can't be done until someone figures out, or IBM releases some specs.

	Thanks for adding yourself into the thread.

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Wed, Jun 22, 2005 at 06:50:59AM -0600, Alejandro Bonilla wrote:
> 
> > Hi!
> >
> > > > I'm trying to do watch -n1 cat /proc/acpi/ibm/ecdump, But
> > I don't have
> > > > ecdump. I'm with ibm-acpi 0.8
> > > >
> > >
> > > I was thinking more along the lines of figure out the io port it's
> > > using, then boot windows, set an IO breakpoint in softice, then drop
> > > your laptop on the bed or something.
> >
> > It should be enough to tilt your laptop so that it parks
> > heads... safer than
> > dropping it.
> >
> > And perhaps easier solution is to locate the sensor on the
> > mainboard, and
> > trace where it is connected with magnifying glass (as vojtech
> > already suggested).
> >
> > 				Pavel
> >
> > --
> > 64 bytes from 195.113.31.123: icmp_seq=28 ttl=51
> > time=448769.1 ms
> >
> 
> /proc/acpi/ibm/ecdump is really not providing any information about this
> sensor. yesterday, I almost broke the laptop to see if it would generate
> anything, but it really only outputs ACPI events...
> 
> I shaked it, moved it 90deg and still no result, threw the lappy from like
> 40cm to the bed and nothing was really generated. Unless it is too fast like
> to generate it in the watch or to be seen by human eye. I dunno.
> 
> It looks like /ecdump won't do it.
 
But that doesn't mean it's not connected to the embedded controller. It
just means the embedded controller doesn't generate any inertial events
by itself - it may have to be polled with some specific command.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: [ltp] Re: IBM HDAPS Someone interested?

[Eric Piel]

06/23/2005 09:13 AM, Vojtech Pavlik wrote/a écrit:
> On Wed, Jun 22, 2005 at 06:50:59AM -0600, Alejandro Bonilla wrote:
> 
>>/proc/acpi/ibm/ecdump is really not providing any information about this
>>sensor. yesterday, I almost broke the laptop to see if it would generate
>>anything, but it really only outputs ACPI events...
>>
>>I shaked it, moved it 90deg and still no result, threw the lappy from like
>>40cm to the bed and nothing was really generated. Unless it is too fast like
>>to generate it in the watch or to be seen by human eye. I dunno.
>>
>>It looks like /ecdump won't do it.
> 
>  
> But that doesn't mean it's not connected to the embedded controller. It
> just means the embedded controller doesn't generate any inertial events
> by itself - it may have to be polled with some specific command.
> 

Well, in the changelog of the embedded controller firmware 
(ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/1uhj07us.txt) there is:
- (New) Support for IBM Hard Disk Active Protection System.

I would conclude that the embedded controller is involved with the HDAPS!

Just my two cents.

Eric

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

  
> > But that doesn't mean it's not connected to the embedded 
> controller. It
> > just means the embedded controller doesn't generate any 
> inertial events
> > by itself - it may have to be polled with some specific command.
> > 
> 
> Well, in the changelog of the embedded controller firmware 
> (ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/1uhj07us.txt) there is:
> - (New) Support for IBM Hard Disk Active Protection System.
> 
> I would conclude that the embedded controller is involved 
> with the HDAPS!
> 
> Just my two cents.
> 
> Eric
> 
OK, awesome. This gives us pretty much a where to go from now.

Should the IBM-ACPI project have anything to do with this? I mean, we should, or could be getting more -vvv information from ecdump or the fact that because this is attached to the embedded controller makes things harder?

.Alejandro

Re: [ltp] Re: IBM HDAPS Someone interested?

[Vojtech Pavlik]

On Thu, Jun 23, 2005 at 06:53:15AM -0600, Alejandro Bonilla wrote:
>   
> > > But that doesn't mean it's not connected to the embedded 
> > controller. It
> > > just means the embedded controller doesn't generate any 
> > inertial events
> > > by itself - it may have to be polled with some specific command.
> > > 
> > 
> > Well, in the changelog of the embedded controller firmware 
> > (ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/1uhj07us.txt) there is:
> > - (New) Support for IBM Hard Disk Active Protection System.
> > 
> > I would conclude that the embedded controller is involved 
> > with the HDAPS!
> > 
> > Just my two cents.
> > 
> > Eric
> > 
> OK, awesome. This gives us pretty much a where to go from now.
> 
> Should the IBM-ACPI project have anything to do with this? I mean, we
> should, or could be getting more -vvv information from ecdump or the
> fact that because this is attached to the embedded controller makes
> things harder?
 
We'll likely have to take a look at the extra IBM ACPI BIOS methods the
BIOS exports and see if any of them is interfacing to the EC.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: [ltp] Re: IBM HDAPS Someone interested?

[Jan Knutar]

On Tuesday 21 June 2005 02:35, Lee Revell wrote:

> I was thinking more along the lines of figure out the io port it's
> using, then boot windows, set an IO breakpoint in softice, then drop
> your laptop on the bed or something.

io ports 0x2E, 0x2F and 0xED aren't assigned to anything "known"
on other computers, are they? Someone with windows, softice and
tendency to reach deep insights into life, the universe and everything,
might find it fun to stare at.

Re: [ltp] Re: IBM HDAPS Someone interested?

[Lee Revell]

On Thu, 2005-06-23 at 18:33 +0300, Jan Knutar wrote:
> On Tuesday 21 June 2005 02:35, Lee Revell wrote:
> 
> > I was thinking more along the lines of figure out the io port it's
> > using, then boot windows, set an IO breakpoint in softice, then drop
> > your laptop on the bed or something.
> 
> io ports 0x2E, 0x2F and 0xED aren't assigned to anything "known"
> on other computers, are they? Someone with windows, softice and
> tendency to reach deep insights into life, the universe and everything,
> might find it fun to stare at.
> 

Now you're talking my language... nope, they aren't used on any of my
machines... hmm...  Anyone want to lend me their Thinkpad? ;-P

On a related note, I found it kind of depressing when I went to RE a
Windows driver, I got millions of hits on how to crack copy protection
on games, and only one guide to RE for Linux driver development:

http://dxr3.sourceforge.net/re.html

I'd really like to create a HOWTO, as there are some tricky aspects
(like getting your IDA Pro symbols loaded into SoftICE), and it's much
easier to find the register write routines than the document indicates.
Just grep for "inb", "outb" and friends, most likely they each appear
exactly once.

Of course, with IO breakpoints, you don't even have to do that, but the
register read/write routines are a good place to work backwards from...

Lee

Re: [ltp] Re: IBM HDAPS Someone interested?

[Eric Piel]

06/23/2005 02:53 PM, Alejandro Bonilla wrote/a écrit:
>   
>>Well, in the changelog of the embedded controller firmware 
>>(ftp://ftp.software.ibm.com/pc/pccbbs/mobiles/1uhj07us.txt) there is:
>>- (New) Support for IBM Hard Disk Active Protection System.
>>
>>I would conclude that the embedded controller is involved 
>>with the HDAPS!
>>
>>Just my two cents.
>>
>>Eric
>>
> 
> OK, awesome. This gives us pretty much a where to go from now.
> 
> Should the IBM-ACPI project have anything to do with this? I mean, we should, or could be getting more -vvv information from ecdump or the fact that because this is attached to the embedded controller makes things harder?
> 
Just to add a few more cents, googling around I found that Paul Sladen 
has already been looking for some info on the chip. Started to RE the 
windows driver, this kind of info _might_ be useful :
Windows drivers read in 28-bytes via an IOCTL(0x733fc) on "\ShockMgr" . 
  (See shockprf.sys)

http://www.paul.sladen.org/thinkpad-r31/accelerometer.html
http://www.paul.sladen.org/thinkpad-r31/aps/

Eric (who is looking forward playing Neverball the Right Way (tm) ;-) )


PS: I don't know Paul Sladen's address and couldn't find it on his 
webpage. Hopping this email address will do it anyway.

Re: [ltp] Re: IBM HDAPS Someone interested?

[Lee Revell]

On Thu, 2005-06-23 at 22:22 +0200, Eric Piel wrote:
> 06/23/2005 02:53 PM, Alejandro Bonilla wrote/a écrit:
> Just to add a few more cents, googling around I found that Paul Sladen 
> has already been looking for some info on the chip. Started to RE the 
> windows driver, this kind of info _might_ be useful :
> Windows drivers read in 28-bytes via an IOCTL(0x733fc) on "\ShockMgr" . 
>   (See shockprf.sys)
> 
> http://www.paul.sladen.org/thinkpad-r31/accelerometer.html
> http://www.paul.sladen.org/thinkpad-r31/aps/
> 
> Eric (who is looking forward playing Neverball the Right Way (tm) ;-) )
> 
> 
> PS: I don't know Paul Sladen's address and couldn't find it on his 
> webpage. Hopping this email address will do it anyway.
> 

Yup, it's just doing port IO.  Get a kernel debugger for windows like
softice and this will be trivial to RE.

READ_PORT_USHORT
WRITE_PORT_UCHAR
READ_PORT_UCHAR

Lee

Re: [ltp] Re: IBM HDAPS Someone interested?

[Andrew Haninger]

On 6/23/05, Lee Revell <rlrevell@joe-job.com> wrote:
> Anyone want to lend me their Thinkpad? ;-P
While I'd like APS support on my Thinkpad while running Linux as much
as the next guy/gal, I'm not sure that I'm ready to do this just yet
(unless someone on the Ohio State University campus thinks they can do
something, in which case, contact me off-list).

However, if the more knowledgeable hardware hackers amongst us could
put together some instructions for the daring but not-yet-initiated of
us that happen to have this hardware, I'd be happy to try to do what I
can.

Someone else mentioned SoftIce, which appears to cost more than 0USD,
so I'm not going to get and try that right away. Are there any other
low-cost methods of getting detailed information about the hardware as
it's initialized and used?

-Andy

Re: [ltp] Re: IBM HDAPS Someone interested?

[Parag Warudkar]

> 
> Someone else mentioned SoftIce, which appears to cost more than 0USD,
> so I'm not going to get and try that right away. Are there any other
> low-cost methods of getting detailed information about the hardware as
> it's initialized and used?
> 
> -Andy

If you have 2 machines with FireWire ports - The kernel debugger that comes with Windows DDK is also very easy to use and quite useful for such things( at least that's what I found last time when I was having nausea from ndiswrapper :). 

Windows DDK is not downloadable for free  but it's very cheap to order a CD (~ 9USD IIRC).

Parag

Re: [ltp] Re: IBM HDAPS Someone interested?

[P]

Lee Revell wrote:
> On Thu, 2005-06-23 at 18:33 +0300, Jan Knutar wrote:
> 
>>On Tuesday 21 June 2005 02:35, Lee Revell wrote:
>>
>>
>>>I was thinking more along the lines of figure out the io port it's
>>>using, then boot windows, set an IO breakpoint in softice, then drop
>>>your laptop on the bed or something.
>>
>>io ports 0x2E, 0x2F and 0xED aren't assigned to anything "known"
>>on other computers, are they?

Generally watchdogs use 2[EF]

Pádraig.

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

> >
> > io ports 0x2E, 0x2F and 0xED aren't assigned to anything "known"
> > on other computers, are they? Someone with windows, softice and
> > tendency to reach deep insights into life, the universe and
> everything,
> > might find it fun to stare at.
> >
>
> Now you're talking my language... nope, they aren't used on any of my
> machines... hmm...  Anyone want to lend me their Thinkpad? ;-P
>
>
> Of course, with IO breakpoints, you don't even have to do
> that, but the
> register read/write routines are a good place to work
> backwards from...
>
> Lee
>
>


Lee,

	I can lend you the laptop with SSH. :) I'll out the dammed thing with a
public IP and anyone can do whatever they want to with it. (Of course, that
won't kill the PC)  ;-|

	That is all I can do.

Also, if anyone wants to check this pdf, it talks about the protection
system and how well it worked...

http://www-605.ibm.com/misc_includes/en_IN/drop_test.pdf

.Alejandro

RE: [ltp] Re: IBM HDAPS Someone interested?

[Alejandro Bonilla]

Guys/Gals,

Let's please NOT drop this subject... But I think we can do it somewhere
else...

If you are some sort of engineer, but don't have an IBM laptop. Feel free to
help us.
If you own a IBM laptop and care about HD APS or will get a laptop in the
future with this, please continue with us.
If you want to follow the project anyway, please feel free to join us.
And of course. If you know about making drivers... :) don't hesitate to join
us either...

I created a mailing list. Let's see if we can continue with this and get HD
APS to work.

http://lists.sourceforge.net/lists/listinfo/hdaps-devel

Let's keep trying....

.Alejandro



>
> Now you're talking my language... nope, they aren't used on any of my
> machines... hmm...  Anyone want to lend me their Thinkpad? ;-P
>
> On a related note, I found it kind of depressing when I went to RE a
> Windows driver, I got millions of hits on how to crack copy protection
> on games, and only one guide to RE for Linux driver development:
>
> http://dxr3.sourceforge.net/re.html
>
> I'd really like to create a HOWTO, as there are some tricky aspects
> (like getting your IDA Pro symbols loaded into SoftICE), and it's much
> easier to find the register write routines than the document
> indicates.
> Just grep for "inb", "outb" and friends, most likely they each appear
> exactly once.
>
> Of course, with IO breakpoints, you don't even have to do
> that, but the
> register read/write routines are a good place to work
> backwards from...
>
> Lee