Linux already on HP Prime G2!

[compsystems]

https://tiplanet.org/forum/viewtopic.php?p=244225


Full xcas someday =)

[akmon]

Very interesting, but risky. It requires G2 with hardware mods, including weldings.

[Claudio L.]

A very promising advance!
Once all the reverse engineering data is collected (he got a lot already), we shouldn't need any hardware mods anymore. The only reason for the hardware mods is to boot in the chip manufacturer mode, before loading any bootloader or firmware from HP. Having alternative firmware loaded by HP's boot loader and updated through the HP Prime connectivity kit should be possible, but more information is needed before anyone can get that done. It was done by Boric for the G1, there's no reason to think the ROM format for the G2 would be too different, but so far nobody knew what to put in that alternative ROM. Now there's at least a few pieces of the puzzle.

[Jean-Baptiste Boric]

Well, just about the only thing in common between G1 and G2 is that they look identical externally. They have completely different hardware, firmware, OS, recovery, booting mechanism and so on. Also, unlike the G1 we can't just hitch a ride on HP's firmware because a chain of trust is enforced (however, a root of trust is not enforced, so booting non-HP firmware is possible through the SoC's recovery, it does require opening the calculator up but hardware mods aren't necessary, I guess Zephray never tried to apply 3.3v on TP907 during reset).

I've had SoC's recovery and JTAG running since last December, but I just couldn't get the gosh darn DDR controller to work. That's the main breakthrough of Zephray (alongside reverse-engineering most of the hardware on the way) which allows running U-Boot and Linux on the calculator. I'm must say I'm thoroughly impressed by how quickly Zephray achieved such results in less than a week. Then again, reverse-engineering hardware is really not my cup of tea, it's cool seeing in action someone who actually knows what they're doing at this stuff.

[Claudio L.]

(07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote:  Well, just about the only thing in common between G1 and G2 is that they look identical externally. They have completely different hardware, firmware, OS, recovery, booting mechanism and so on. Also, unlike the G1 we can't just hitch a ride on HP's firmware because a chain of trust is enforced (however, a root of trust is not enforced, so booting non-HP firmware is possible through the SoC's recovery, it does require opening the calculator up but hardware mods aren't necessary, I guess Zephray never tried to apply 3.3v on TP907 during reset).

Are you sure you can't replace the firmware? I don't know the specifics of this particular chip but in general even when enforcing secure boot only the lowest level bootloader needs to be signed (usually called BL1 or similar). Once the internal boot ROM verified that signature, control is transferred and it's entirely up to that code what can be loaded, and most other security features are just sitting there waiting to be enabled by that same signed code, if it doesn't do it then we are good. Typically that BL1 loads another 2nd stage bootloader like uboot, but that one only needs to be signed if whoever wrote BL1 requires it. Unless HP specifically required their firmware to be signed it shouldn't be. Perhaps there's some kind of checksum used to check integrity, but I don't think any signature would be required.
I think I remember a comment from Tim stating it wasn't locked but they had all the means ready to do so if somebody messed with the exam mode.

(07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote:  I've had SoC's recovery and JTAG running since last December, but I just couldn't get the gosh darn DDR controller to work. That's the main breakthrough of Zephray (alongside reverse-engineering most of the hardware on the way) which allows running U-Boot and Linux on the calculator. I'm must say I'm thoroughly impressed by how quickly Zephray achieved such results in less than a week. Then again, reverse-engineering hardware is really not my cup of tea, it's cool seeing in action someone who actually knows what they're doing at this stuff.

The fact you got JTAG running shows they didn't try to activate the security features, since Freescale includes secured JTAG as well. These newer CPUs are much harder to bring up than the older generations so don't feel bad, I agree his progress was incredibly fast, a very talented individual.

[Jean-Baptiste Boric]

(07-18-2019 01:53 AM)Claudio L. Wrote:  Are you sure you can't replace the firmware? I don't know the specifics of this particular chip but in general even when enforcing secure boot only the lowest level bootloader needs to be signed (usually called BL1 or similar).

As I said, HP's firmware enforces a chain of trust, but the hardware does not enforce a root of trust. We can boot whatever we want, whether it's from the SoC's recovery or the NAND. However, once the calculator runs HP's official firmware it's a one-way trip until reset. The chain of trust extends to HP's official recovery, so you can't upload an unofficial firmware through it.

So yes, the firmware can be replaced, but unlike G1 we can't hitch a ride on HP's official firmware. Once HP's code runs, it's effectively game over until reset.

[Claudio L.]

(07-18-2019 04:06 PM)Jean-Baptiste Boric Wrote:  As I said, HP's firmware enforces a chain of trust, but the hardware does not enforce a root of trust. We can boot whatever we want, whether it's from the SoC's recovery or the NAND. However, once the calculator runs HP's official firmware it's a one-way trip until reset. The chain of trust extends to HP's official recovery, so you can't upload an unofficial firmware through it.

So yes, the firmware can be replaced, but unlike G1 we can't hitch a ride on HP's official firmware. Once HP's code runs, it's effectively game over until reset.

If you are right then, well... I guess HP slammed the door shut for us. It would've been nice to simply use the connectivity kit to flash alternative firmware like you did on the G1.
I'm thinking the right solution would be to somehow move HP bootloader to a different area of flash and put a more generic u-boot to boot from NAND (easier said than done unless you have done the hardware mod, even the simpler one you suggested of putting 3.3V on a test point would be a big deterrent for 99.9% of the users). Then a u-boot script could have a menu to either load HP's bootloader from the alternative location and launch it, or a custom firmware from the user.
In any case, just the fact it requires the users to open the calculators to do the mod means very few people would ever attempt it. What's the point in publishing anything for this platform if it's so hard to use it?

When the G2 was announced I had already started working on the newRPL port for the G1 (basic boot and drivers). I stopped because I thought there was no sense in working on yet another dead hardware platform, and was waiting and hoping for good news to start working on the G2 hardware. Now I'm afraid the G2 is as dead as the G1 for my use case. Even if we were able to do an open boot as I described above, only a couple of people would dare to do it.

This thread started as very good news, now I'm really disappointed.

[cdmackay]

(07-18-2019 08:44 PM)Claudio L. Wrote:  When the G2 was announced I had already started working on the newRPL port for the G1 (basic boot and drivers). I stopped because I thought there was no sense in working on yet another dead hardware platform, and was waiting and hoping for good news to start working on the G2 hardware. Now I'm afraid the G2 is as dead as the G1 for my use case. Even if we were able to do an open boot as I described above, only a couple of people would dare to do it.

I would buy another G2 just for that purpose, just like I did a second 50g for newRPL, for which many thanks.

[mfleming]

(07-18-2019 09:23 PM)cdmackay Wrote:  

(07-18-2019 08:44 PM)Claudio L. Wrote:  When the G2 was announced I had already started working on the newRPL port for the G1 (basic boot and drivers). I stopped because I thought there was no sense in working on yet another dead hardware platform, and was waiting and hoping for good news to start working on the G2 hardware. Now I'm afraid the G2 is as dead as the G1 for my use case. Even if we were able to do an open boot as I described above, only a couple of people would dare to do it.

I would buy another G2 just for that purpose, just like I did a second 50g for newRPL, for which many thanks.

It's much more likely that someone would buy a pre-modded G2 with newRPL installed that could be easily updated with new code releases. Compare the price of a new G2 to that of a DM42, and have a look at Eric's ready-built WP34 for some ideas of feasibility.

~Mark

[Claudio L.]

(07-19-2019 01:20 AM)mfleming Wrote:  

(07-18-2019 09:23 PM)cdmackay Wrote:  I would buy another G2 just for that purpose, just like I did a second 50g for newRPL, for which many thanks.

It's much more likely that someone would buy a pre-modded G2 with newRPL installed that could be easily updated with new code releases. Compare the price of a new G2 to that of a DM42, and have a look at Eric's ready-built WP34 for some ideas of feasibility.

~Mark

Yes, assuming somebody would put the effort to buy, mod and re-sell a G2.
But that same person buying a modded G2 could:
a) Just buy a used (or new) G1 and never need a mod (and G1s price will come down, since the G2 is essentially identical but faster, there's no advantage whatsoever to the G1 vs G2). And I bet if the G2 marketing machine catches on, many people that already own a Prime would buy a G2 and sell their used G1's, bringing the price even further down.
b) For people that already have a G1, perhaps buy a G2 to be used as a Prime, then use their old G1s to flash newRPL.

I agree the price of DM42 is high, so is the 50g hardware nowadays. The G1 on the other hand, I can't think of any reason for the price to go up post-mortem. A quick historic review shows the calcs that became very expensive post-mortem had something unique or special, I don't see it on the Prime G1, since the G2 looks and works exactly the same save for the extra memory and speed (enlighten me if I'm wrong!).

[DrD]

Of the entire population of all calculator users, what percentage of them use RPL? Of all those RPL users, what percentage of (them), would want a modified calculator in order to run RPL?

My sense is that by the time the population is filtered to those few that would buy a modified calculator, expressly for the purpose of using RPL, the actual number will be pretty small.

I have several calculators, many of them with RPL, and frankly, the only one I ever use is an hp prime (G2), anymore. In fact, most of my calc use is with the hp prime virtual calc, which I use pretty much every day. I would be completely content if RPL wasn't supported at all. RPL was a great idea, but python, and other computer software, makes even using a handheld calculator at all, less important than it ever was when RPL was the demand item.

It seems like RPL on the prime, is a tail-chasing exercise, with diminishing returns. If you have the "bound-to's" and are so driven that you have to prove this exercise, then no harm is done in the pursuit. If it is expected that running RPL on a modified calculator will be a huge forward techno-leap, I'm not thinking the masses will agree, or will beat a path to your doorway.

Good luck, it will be interesting to watch the activity unravel, one way or the other.

[BruceH]

(07-18-2019 01:53 AM)Claudio L. Wrote:  The fact you got JTAG running shows they didn't try to activate the security features, since Freescale includes secured JTAG as well.

I'm sure I recall CdB saying that they weren't going to make a big deal over security unless someone enables a way to fake the exam mode lights - and then they would have to crack down hard.

[pvp100288840]

(07-18-2019 01:53 AM)Claudio L. Wrote:  

(07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote:  Well, just about the only thing in common between G1 and G2 is that they look identical externally. They have completely different hardware, firmware, OS, recovery, booting mechanism and so on. Also, unlike the G1 we can't just hitch a ride on HP's firmware because a chain of trust is enforced (however, a root of trust is not enforced, so booting non-HP firmware is possible through the SoC's recovery, it does require opening the calculator up but hardware mods aren't necessary, I guess Zephray never tried to apply 3.3v on TP907 during reset).

Are you sure you can't replace the firmware? I don't know the specifics of this particular chip but in general even when enforcing secure boot only the lowest level bootloader needs to be signed (usually called BL1 or similar). Once the internal boot ROM verified that signature, control is transferred and it's entirely up to that code what can be loaded, and most other security features are just sitting there waiting to be enabled by that same signed code, if it doesn't do it then we are good. Typically that BL1 loads another 2nd stage bootloader like uboot, but that one only needs to be signed if whoever wrote BL1 requires it. Unless HP specifically required their firmware to be signed it shouldn't be. Perhaps there's some kind of checksum used to check integrity, but I don't think any signature would be required.
I think I remember a comment from Tim stating it wasn't locked but they had all the means ready to do so if somebody messed with the exam mode.

(07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote:  I've had SoC's recovery and JTAG running since last December, but I just couldn't get the gosh darn DDR controller to work. That's the main breakthrough of Zephray (alongside reverse-engineering most of the hardware on the way) which allows running U-Boot and Linux on the calculator. I'm must say I'm thoroughly impressed by how quickly Zephray achieved such results in less than a week. Then again, reverse-engineering hardware is really not my cup of tea, it's cool seeing in action someone who actually knows what they're doing at this stuff.

The fact you got JTAG running shows they didn't try to activate the security features, since Freescale includes secured JTAG as well. These newer CPUs are much harder to bring up than the older generations so don't feel bad, I agree his progress was incredibly fast, a very talented individual.

They said they will take steps "if somebody messed with the exam mode"?
Come on,according to their firmware ,I think they are too simple to block out others cracking their products.
They programed firmware badly ,which made it impossible to even use the storage space completely.
LMAO.

[aloof]

(07-17-2019 05:29 PM)Jean-Baptiste Boric Wrote:  Also, unlike the G1 we can't just hitch a ride on HP's firmware because a chain of trust is enforced (however, a root of trust is not enforced, so booting non-HP firmware is possible through the SoC's recovery, it does require opening the calculator up but hardware mods aren't necessary, I guess Zephray never tried to apply 3.3v on TP907 during reset).

Hi, I am an electronics enthusiast who has just gotten into hardware reverse engineering and embedded programming. I just received my hp prime g2 and was able to get the back removed. I want to get a custom image of linux running but am a little nervous because I haven't tinkered with hardware before.

Can someone explain to me what the difference is between applying a 3.3v to TP907 and shorting the BootMode1 and ground pins. What is TP907 (I see the pin next to the cpu but what is the pin for?) Also what effect does shorting the other pins have? Is using zephray's prinux repo the best way of getting linux running or can I run a similar setup using yocto project?

Thanks for all the help!

Also, I am not a student looking to turn the blinky light on, this is for educational and entertainment purposes only

[Jean-Baptiste Boric]

(11-17-2020 03:23 AM)aloof Wrote:  Hi, I am an electronics enthusiast who has just gotten into hardware reverse engineering and embedded programming. I just received my hp prime g2 and was able to get the back removed. I want to get a custom image of linux running but am a little nervous because I haven't tinkered with hardware before.

Can someone explain to me what the difference is between applying a 3.3v to TP907 and shorting the BootMode1 and ground pins. What is TP907 (I see the pin next to the cpu but what is the pin for?) Also what effect does shorting the other pins have? Is using zephray's prinux repo the best way of getting linux running or can I run a similar setup using yocto project?

Thanks for all the help!

Also, I am not a student looking to turn the blinky light on, this is for educational and entertainment purposes only

Check out https://github.com/zephray/prinux for a complete guide on how to boot Linux on your HP Prime. Technical details about the hardware itself can be found at https://www.zephray.me/post/hp_prime_g2_...ngineering and in the i.MX 6ULL datasheets.

Obviously this will void your warranty, but as long as you are careful (as in not-shorting-something-with-5V careful) it should be perfectly safe.

[Valentin Albillo]

.
Hi, Claudio L.

(07-18-2019 01:53 AM)Claudio L. Wrote:  I think I remember a comment from Tim stating it wasn't locked but they had all the means ready to do so if somebody messed with the exam mode.

This is Tim Wessman's exact quote you mention:

"It is not locked down and is just used for verification at this time. Note however, we DO have the ability to fully encrypt and lock the system to hell as that is part of the new chip. We DO have that tested and working. We WILL turn it on if needed. It IS a corporate security mandate (after things like firmware being loaded into mice/keyboard or printers to hack networks came to light) that we fought to get an exemption for.

Nobody dick around with exam mode."

Best regards.
V.

[Sukiari]

(11-17-2020 11:51 PM)Valentin Albillo Wrote:  .
Hi, Claudio L.

(07-18-2019 01:53 AM)Claudio L. Wrote:  I think I remember a comment from Tim stating it wasn't locked but they had all the means ready to do so if somebody messed with the exam mode.

This is Tim Wessman's exact quote you mention:

"It is not locked down and is just used for verification at this time. Note however, we DO have the ability to fully encrypt and lock the system to hell as that is part of the new chip. We DO have that tested and working. We WILL turn it on if needed. It IS a corporate security mandate (after things like firmware being loaded into mice/keyboard or printers to hack networks came to light) that we fought to get an exemption for.

Nobody dick around with exam mode."

Best regards.
V.

I think Tim’s going to find HP in a war with its users, one it can not win, like TI has.

[OtakuLab]

(11-20-2020 02:43 AM)Sukiari Wrote:  I think Tim’s going to find HP in a war with its users, one it can not win, like TI has.

You're damn right, it's actually unbelievable that there are still people in the 21st century who just don't want to see that there are absolutely always ways and means in electronics to switch off or bypass a system. It's exactly the same with online banking, you can add as many security codes and hurdles as you want, but in the end there will never be 100% security.
__________________________________
"Move forward and do what you think is best. If you make a mistake, you’ll learn something. But don’t make the same mistake twice." - Akio Morita

[Han]

(11-20-2020 08:08 AM)OtakuLab Wrote:  

(11-20-2020 02:43 AM)Sukiari Wrote:  I think Tim’s going to find HP in a war with its users, one it can not win, like TI has.

You're damn right, it's actually unbelievable that there are still people in the 21st century who just don't want to see that there are absolutely always ways and means in electronics to switch off or bypass a system. It's exactly the same with online banking, you can add as many security codes and hurdles as you want, but in the end there will never be 100% security.
__________________________________
"Move forward and do what you think is best. If you make a mistake, you’ll learn something. But don’t make the same mistake twice." - Akio Morita

I don't think it's so much a refusal to acknowledge that security can be bypassed as much as it is a desire to avoid opening a can of worms. I don't work for HP and am indifferent on whether they choose to lock down their hardware in the future. I think the underlying message, though, is that it benefits neither side to breach this unwritten "contract." From HP's side, it's wasting their time that they could be devoting toward improving a product. From the tinker's side -- if their goal is to actually tinker beyond just breaking security -- it's a waste of their time trying to break new security just so they can go back to doing their tinkering. Sure, there will be those who want to break security simply as an academic endeavor, but I don't think that is the majority of the tinkering group. I.e. people try to get around security measures for the purpose of other interests (e.g. custom firmware), and not just for the sake of breaking security.

[ramon_ea1gth]

I agree with the points exposed by Han. I started this year following the news in this forum and got an HP Prime G2. I was nicely surprised with the efforts of the people directly involved in the HP Prime design (engineers/math specialists), personally attending the questions that arise here, instead of third-party staff: that's a luxury!
Of course, each of us has its own preferences: e.g., me, coming from the HP 48-50 world (that I love), have a way of doing things and certain uses, that I am adapting to the HP Prime style, and are also useful to understand the way it works.

But what I would like is that the, I guess, tight working agenda of the developers, be properly focused at continuously improving the HP Prime ecosystem and continue attending, when possible, the suggestions that arise in this forum. The machine and its ecosystem (connectivity/virtual calculator), looks a pretty complex design with lots of possibilities that I bet, requires calm and dedication to continue delivering a stable product. So adding unneccessary troubles to the limited time of the design team would be a shame, including the time they spend attending personally this forum, for which I am grateful.