[Transmeta hardware] Update of the CMS under Linux ?

[Transmeta hardware] Update of the CMS under Linux ?

[Emmanuel Fleury]

Hi,

I would like to know if there is any hope to have a software that allow
us to update the Transmeta CMS (Code Morphing Software) from Linux ?

I tried to google around but I never managed to find something valuable.
The only valuable link seems to be this one:
http://h18007.www1.hp.com/support/files/compaqtabletpc/us/download/18120.html

So, it seems to be possible.

I have a CMS 4.3.2 on my computer (see below) but the 4.4 is now out
(see: http://www.theinquirer.net/?article=8071 or
http://www.realworldtech.com/page.cfm?ArticleID=RWT010204000000&p=3 ,
first sentence) and I think there is a bug in the one I have (see:
http://freedesktop.org/bugzilla/show_bug.cgi?id=455).

My version of the CMS is: 
CPU: After generic identify, caps: 0080893f 0081813f 00000000 00000000
CPU: After vendor identify, caps:  0080893f 0081813f 0000004e 00000000
CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (32 bytes/line)
CPU: L2 Cache: 512K (128 bytes/line)
CPU: Processor revision 1.4.1.0, 933 MHz
CPU: Code Morphing Software revision 4.3.2-9-343
CPU: 20020426 17:54 official release 4.3.2#2
CPU: After all inits, caps:        0080893f 0081813f 0000004e 00000000
CPU: Transmeta(tm) Crusoe(tm) Processor TM5800 stepping 03



See also:
http://www.leog.net/fujp_forum/topic.asp?ARCHIVE=true&TOPIC_ID=2159

Regards
-- 
Emmanuel Fleury
 
Computer Science Department, |  Office: B1-201
Aalborg University,          |  Phone:  +45 96 35 72 23
Fredriks Bajersvej 7E,       |  Fax:    +45 98 15 98 89
9220 Aalborg East, Denmark   |  Email:  fleury@cs.auc.dk

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Kalin KOZHUHAROV]

Emmanuel Fleury wrote:
> Hi,
> 
> I would like to know if there is any hope to have a software that allow
> us to update the Transmeta CMS (Code Morphing Software) from Linux ?
> 
> I tried to google around but I never managed to find something valuable.
> The only valuable link seems to be this one:
> http://h18007.www1.hp.com/support/files/compaqtabletpc/us/download/18120.html
> 
> So, it seems to be possible.
> 
> I have a CMS 4.3.2 on my computer (see below) but the 4.4 is now out
> (see: http://www.theinquirer.net/?article=8071 or
> http://www.realworldtech.com/page.cfm?ArticleID=RWT010204000000&p=3 ,
> first sentence) and I think there is a bug in the one I have (see:
> http://freedesktop.org/bugzilla/show_bug.cgi?id=455).
> 
> My version of the CMS is: 
> CPU: After generic identify, caps: 0080893f 0081813f 00000000 00000000
> CPU: After vendor identify, caps:  0080893f 0081813f 0000004e 00000000
> CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (32 bytes/line)
> CPU: L2 Cache: 512K (128 bytes/line)
> CPU: Processor revision 1.4.1.0, 933 MHz
> CPU: Code Morphing Software revision 4.3.2-9-343
> CPU: 20020426 17:54 official release 4.3.2#2
> CPU: After all inits, caps:        0080893f 0081813f 0000004e 00000000
> CPU: Transmeta(tm) Crusoe(tm) Processor TM5800 stepping 03
> 
> 
> See also:
> http://www.leog.net/fujp_forum/topic.asp?ARCHIVE=true&TOPIC_ID=2159

Your post got me thinking and searching as I have a Toshiba Libretto here:

CPU: Processor revision 1.4.1.0, 800 MHz
CPU: Code Morphing Software revision 4.2.9-8-344
CPU: 20020222 15:08 official release 4.2.9#1
CPU: Transmeta(tm) Crusoe(tm) Processor TM5800 stepping 03

I couldn't find any traces to CMS updating (even on Windoze).

Tried Toshiba site, Transmeta site, Google.

Is there any way at all to update it (even from Windoze)?

Just send an e-mail inquiry to Transmeta Inc., will post any answer here.

Kalin.

-- 
 || ~~~~~~~~~~~~~~~~~~~~~~ ||
(  ) http://ThinRope.net/ (  )
 || ______________________ ||

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Emmanuel Fleury]

Hi,

Actually, I have an answer to my question by now.

The way the CMS is built-in on the hardware allow one way to upgrade the
firmware (and only one, as far as I understood in
http://www.realworldtech.com/page.cfm?ArticleID=RWT010204000000 and
http://www.realworldtech.com/page.cfm?ArticleID=RWT012704012616).

Each upgrade has to be signed with a certain private key (this private
key is known by the seller of the laptop (Toshiba in your case) and by
Transmeta itself... well I assume that in fact each entity has a partial
knowledge of the private key which makes impossible to one of these to
do something without the agreement of the other one).

So, the process for upgrading the CMS firmware is the following:

1) Load the upgrade in memory,
2) Check the signature of the upgrade with the public key stored in the
   ROM.
3) If the signature match with the upgrade, then apply the upgrade.

As you see, an upgrade (for Linux or Windows, whatever) requires the
agreement of both Transmeta AND the laptop seller. And you cannot easily
hack your way through.

I see only two solutions to do our own upgrade of the CMS:

1) Take the EPROM out and write our own public key on it...
   (risky and need a lot of hardware. I wouldn't recommand this way)

2) Crack the public/private keys of the hardware.
   (this is a known plaintext attack for the HP tablet-PC, and for the
    other hardwares we can only have access to the public-key which is
    making it more difficult but nothing that can resist to a brute
    force attack in the case we have enough Seti-like softwares
    running).

I have no idea if it is legal or not... it is not my concern now. 
I'm just seeking for solutions ! :)
I guess it depends if you are in the States or in Europe.

So, I am about here in my investigations and I still have this annoying
bug with the Xserver... Moreover, it seems that Transmeta is fully on
the Efficeon now and does not want to invest time and money on looking
for a bug in the Crusoe CMS (except if one of its customer is
specifically asking for it, which is very unlikely from Sony and/or
Fujitsu).

I am gathering some informations on a bug in the CMS here:
http://www.cs.auc.dk/~fleury/bug_cms/index.html

But, it looks like we are f**ked. :)

That's pretty annoying as these Transmeta laptops are an extremely cool
piece of hardware !!! :-/

Anyway, I won't give up so easily (for once that we have a nice bug to
fight with) !!! :)

Regards
-- 
Emmanuel Fleury

Computer Science Department, |  Office: B1-201
Aalborg University,          |  Phone:  +45 96 35 72 23
Fredriks Bajersvej 7E,       |  Fax:    +45 98 15 98 89
9220 Aalborg East, Denmark   |  Email:  fleury@cs.aau.dk

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Marcus Metzler]

>>>>> "Emmanuel" == Emmanuel Fleury <fleury@cs.aau.dk> writes:

    Emmanuel> Hi, Actually, I have an answer to my question by now.

    Emmanuel> The way the CMS is built-in on the hardware allow one
    Emmanuel> way to upgrade the firmware (and only one, as far as I
    Emmanuel> understood in
    Emmanuel> http://www.realworldtech.com/page.cfm?ArticleID=RWT010204000000
    Emmanuel> and
    Emmanuel> http://www.realworldtech.com/page.cfm?ArticleID=RWT012704012616).


    Emmanuel> I am gathering some informations on a bug in the CMS
    Emmanuel> here: http://www.cs.auc.dk/~fleury/bug_cms/index.html

I read the description of your bug and discovered that my problems
with my Fujitsu Biblo Loox T93C notebook (AFAIK the Japanese version
of the Lifebook 2120) seem to have the same cause. Since you seem to
be collecting a list of hardware that has this bug, here is my
information:
I am using debian testing with kernel 2.6.4 (from kernel.org) and
XFree86 Version 4.3.0.1. dmesg gives the following information about
the CMS version: 

CPU:     After generic identify, caps: 0084893f 0081813f 00000000 00000000
CPU:     After vendor identify, caps: 0084893f 0081813f 000000ce 00000000
CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (32 bytes/line)
CPU: L2 Cache: 512K (128 bytes/line)
CPU: Processor revision 1.4.1.0, 933 MHz
CPU: Code Morphing Software revision 4.3.3-9-562
CPU: 20030107 01:17 official release 28.0.1-4.3.3#1
CPU serial number disabled.
CPU:     After all inits, caps: 0080893f 0081813f 000000ce 00000000
CPU: Transmeta(tm) Crusoe(tm) Processor TM5800 stepping 03


Marcus

-- 
/--------------------------------------------------------------------\
| Dr. Marcus O.C. Metzler        |                                   |
| mocm@metzlerbros.de            | http://www.metzlerbros.de/        |
\--------------------------------------------------------------------/
 |>>>             Quis custodiet ipsos custodies                 <<<|

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Emmanuel Fleury]

On Mon, 2004-09-06 at 10:50, Marcus Metzler wrote:
> 
> I read the description of your bug and discovered that my problems
> with my Fujitsu Biblo Loox T93C notebook (AFAIK the Japanese version
> of the Lifebook 2120) seem to have the same cause. Since you seem to
> be collecting a list of hardware that has this bug, here is my
> information:
> I am using debian testing with kernel 2.6.4 (from kernel.org) and
> XFree86 Version 4.3.0.1. dmesg gives the following information about
> the CMS version: 
> 
> CPU:     After generic identify, caps: 0084893f 0081813f 00000000 00000000
> CPU:     After vendor identify, caps: 0084893f 0081813f 000000ce 00000000
> CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (32 bytes/line)
> CPU: L2 Cache: 512K (128 bytes/line)
> CPU: Processor revision 1.4.1.0, 933 MHz
> CPU: Code Morphing Software revision 4.3.3-9-562
> CPU: 20030107 01:17 official release 28.0.1-4.3.3#1
> CPU serial number disabled.
> CPU:     After all inits, caps: 0080893f 0081813f 000000ce 00000000
> CPU: Transmeta(tm) Crusoe(tm) Processor TM5800 stepping 03

Thanks for your input !

I just added it to my list (I keep a more detailled description of each
plateform in my archives).

It's the first 4.3.3 that is reported to have the bug. :)

Regards
-- 
Emmanuel Fleury

Computer Science Department, |  Office: B1-201
Aalborg University,          |  Phone:  +45 96 35 72 23
Fredriks Bajersvej 7E,       |  Fax:    +45 98 15 98 89
9220 Aalborg East, Denmark   |  Email:  fleury@cs.aau.dk

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Marcus Metzler]

>>>>> "Emmanuel" == Emmanuel Fleury <fleury@cs.aau.dk> writes:

    Emmanuel> On Mon, 2004-09-06 at 10:50, Marcus Metzler wrote:
    >> I read the description of your bug and discovered that my
    >> problems with my Fujitsu Biblo Loox T93C notebook (AFAIK the
    >> Japanese version of the Lifebook 2120) seem to have the same
    >> cause. Since you seem to be collecting a list of hardware that
    >> has this bug, here is my information: I am using debian testing
    >> with kernel 2.6.4 (from kernel.org) and XFree86 Version
    >> 4.3.0.1. dmesg gives the following information about the CMS
    >> version:
    >> 
    >> CPU: After generic identify, caps: 0084893f 0081813f 00000000
    >> 00000000 CPU: After vendor identify, caps: 0084893f 0081813f
    >> 000000ce 00000000 CPU: L1 I Cache: 64K (64 bytes/line), D cache
    >> 64K (32 bytes/line) CPU: L2 Cache: 512K (128 bytes/line) CPU:
    >> Processor revision 1.4.1.0, 933 MHz CPU: Code Morphing Software
    >> revision 4.3.3-9-562 CPU: 20030107 01:17 official release
    >> 28.0.1-4.3.3#1 CPU serial number disabled.  CPU: After all
    >> inits, caps: 0080893f 0081813f 000000ce 00000000 CPU:
    >> Transmeta(tm) Crusoe(tm) Processor TM5800 stepping 03

    Emmanuel> Thanks for your input !

    Emmanuel> I just added it to my list (I keep a more detailled
    Emmanuel> description of each plateform in my archives).

    Emmanuel> It's the first 4.3.3 that is reported to have the
    Emmanuel> bug. :)

I might add that, although I don't have quantitative data, it seems
that since the last X11 upgrade the bug seems to be less frequent.

Marcus

-- 
/--------------------------------------------------------------------\
| Dr. Marcus O.C. Metzler        |                                   |
| mocm@metzlerbros.de            | http://www.metzlerbros.de/        |
\--------------------------------------------------------------------/
 |>>>             Quis custodiet ipsos custodies                 <<<|

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Kalin KOZHUHAROV]

Emmanuel Fleury wrote:
> Hi,
> 
> Actually, I have an answer to my question by now.
> 
> The way the CMS is built-in on the hardware allow one way to upgrade the
> firmware (and only one, as far as I understood in
> http://www.realworldtech.com/page.cfm?ArticleID=RWT010204000000 and
> http://www.realworldtech.com/page.cfm?ArticleID=RWT012704012616).
Wow, these tow articles are eye-openers :-)

I couldn't even remotley think of debugging my CPU :-D

> Each upgrade has to be signed with a certain private key (this private
> key is known by the seller of the laptop (Toshiba in your case) and by
> Transmeta itself... well I assume that in fact each entity has a partial
> knowledge of the private key which makes impossible to one of these to
> do something without the agreement of the other one).
> 
> So, the process for upgrading the CMS firmware is the following:
> 
> 1) Load the upgrade in memory,
> 2) Check the signature of the upgrade with the public key stored in the
>    ROM.
> 3) If the signature match with the upgrade, then apply the upgrade.
> 
> As you see, an upgrade (for Linux or Windows, whatever) requires the
> agreement of both Transmeta AND the laptop seller. And you cannot easily
> hack your way through.
> 
> I see only two solutions to do our own upgrade of the CMS:
> 
> 1) Take the EPROM out and write our own public key on it...
>    (risky and need a lot of hardware. I wouldn't recommand this way)
> 
> 2) Crack the public/private keys of the hardware.
>    (this is a known plaintext attack for the HP tablet-PC, and for the
>     other hardwares we can only have access to the public-key which is
>     making it more difficult but nothing that can resist to a brute
>     force attack in the case we have enough Seti-like softwares
>     running).
Hmm, uniting a few hundred Crusoe users can easily be done, but...

> I have no idea if it is legal or not... it is not my concern now. 
... how legal is it?

> I'm just seeking for solutions ! :)
> I guess it depends if you are in the States or in Europe.
or Japan.

> So, I am about here in my investigations and I still have this annoying
> bug with the Xserver... Moreover, it seems that Transmeta is fully on
> the Efficeon now and does not want to invest time and money on looking
> for a bug in the Crusoe CMS (except if one of its customer is
> specifically asking for it, which is very unlikely from Sony and/or
> Fujitsu).
> 
> I am gathering some informations on a bug in the CMS here:
> http://www.cs.auc.dk/~fleury/bug_cms/index.html
> 
> But, it looks like we are f**ked. :)
> 
> That's pretty annoying as these Transmeta laptops are an extremely cool
> piece of hardware !!! :-/
> 
> Anyway, I won't give up so easily (for once that we have a nice bug to
> fight with) !!! :)

I don't have X on this laptop, but I'll put tonight.

Actually, I was given this laptop after a few major falls (and a hard kick!),
so it is barely mobile, strapped/fixed to a metal board and used mainly via ssh.

I had some nasty bug appearing every couple of days without any trace left with linux-2.6.3
(machine stays on, but no reaction to KBD, network, USB, etc; nothing in the logs, on hte screen, no beeps).
But now with 2.6.8.1 I have 15d uptime :-)

If you get closer to a smaller (than X running) testcase, post it here, so other people (and me) can try easily.

I'd be happy to swich a few (fast) CPUs from SETI@Home to Transmeta@Home if not illegal :-)

Kalin.


-- 
 || ~~~~~~~~~~~~~~~~~~~~~~ ||
(  ) http://ThinRope.net/ (  )
 || ______________________ ||

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Emmanuel Fleury]

On Mon, 2004-09-06 at 16:29, Kalin KOZHUHAROV wrote:
> 
> > I have no idea if it is legal or not... it is not my concern now. 
> ... how legal is it?

I am not a lawyer... :)

Just an unsatisfied customer who try to use properly a piece of hardware
that I own because I paid for it... Am I a criminal because of this ???

> > I'm just seeking for solutions ! :)
> > I guess it depends if you are in the States or in Europe.
> or Japan.

Right. I forgot Japan, of course.

> I don't have X on this laptop, but I'll put tonight.

It would be very interesting to know if you encounter this bug.
This bug has never been reported on a Toshiba Libretto.

> Actually, I was given this laptop after a few major falls (and a hard kick!),
> so it is barely mobile, strapped/fixed to a metal board and used mainly via ssh.
> 
> I had some nasty bug appearing every couple of days without any trace left with linux-2.6.3
> (machine stays on, but no reaction to KBD, network, USB, etc; nothing in the logs, on hte screen, no beeps).
> But now with 2.6.8.1 I have 15d uptime :-)

This bug is know to appear more often on X, but it might appear in some
other places and not having being noticed yet... We don't know...

> If you get closer to a smaller (than X running) testcase, post it here, 
> so other people (and me) can try easily.

I will, but just right now I don't have much time to spend on it, but my
next goal is to identify a way to reproduce it (not an easy task I'm
afraid). So, I will keep people informed.

> I'd be happy to switch a few (fast) CPUs from SETI@Home to Transmeta@Home if not illegal :-)

Well, we should first find where is the bug. ;-)

But, we already have the assembly code of the CMS 4.4 thanks to the HP
tablet-PC update (see:
http://h18007.www1.hp.com/support/files/compaqtabletpc/us/download/18120.html).

So, if some people are interested by this project of
CrackingTransmeta@Home, be my guest. :-)

Regards
-- 
Emmanuel Fleury

Computer Science Department, |  Office: B1-201
Aalborg University,          |  Phone:  +45 96 35 72 23
Fredriks Bajersvej 7E,       |  Fax:    +45 98 15 98 89
9220 Aalborg East, Denmark   |  Email:  fleury@cs.aau.dk

Re: [Transmeta hardware] Update of the CMS under Linux ?

[Marcus Metzler]

>>>>> "Emmanuel" == Emmanuel Fleury <fleury@cs.aau.dk> writes:

    Emmanuel> On Mon, 2004-09-06 at 16:29, Kalin KOZHUHAROV wrote:
    >> > I have no idea if it is legal or not... it is not my concern
    >> now. ... how legal is it?

    Emmanuel> I am not a lawyer... :)

    Emmanuel> Just an unsatisfied customer who try to use properly a
    Emmanuel> piece of hardware that I own because I paid for it... Am
    Emmanuel> I a criminal because of this ???

    >> > I'm just seeking for solutions ! :) > I guess it depends if
    >> you are in the States or in Europe.  or Japan.

    Emmanuel> Right. I forgot Japan, of course.

    >> I don't have X on this laptop, but I'll put tonight.

    Emmanuel> It would be very interesting to know if you encounter
    Emmanuel> this bug.  This bug has never been reported on a Toshiba
    Emmanuel> Libretto.

My brother has a Libretto with a Crusoe, he mentioned something about
X11 crashing, but since his graphics chip seems to have given up the
ghost it is hard to check if it was the CMS or the ATI chip.
I was afraid that my graphics chip would have the same problem, so I
am somewhat relieved that it is the Crusoe.

Marcus


-- 
/--------------------------------------------------------------------\
| Dr. Marcus O.C. Metzler        |                                   |
| mocm@metzlerbros.de            | http://www.metzlerbros.de/        |
\--------------------------------------------------------------------/
 |>>>             Quis custodiet ipsos custodies                 <<<|