T30 BIOS Hack possible - 01C9 ISSUE SOLVED!

Message

danage · #1 Post by **danage** » Wed Jan 18, 2006 5:17 pm

Just got done modding my BIOS into avoiding the 1802 and must say after half a day of work I'm quite disappointed:

-----------> THE 01C9 DIDN'T GO AWAY!!!

My reason for doing it was that the Space + Esc was getting annoying and I thought appending to the whitelist would get rid of it. It didn't.

Here is what I did:
a) modded the BIOS so my Wireless Card (Atheros 3rd Party, not IBM) would be in the whitelist
b) reset the CMOS (after unplugging the battery i was asked date & time) to make sure the 1802-CMOS-patch wasn't effective anymore.

Upon booting, the 1802 does not come back, but the 01C9 does!!! There must be some other routine that checks for secondary ethernet devices that also needs to be bypassed.

Please, anybody with assembler programming experience, can you help 10000000 of thinkpad users out and figure something out? I'm willing to put time in this, but I have no disassembling/debugging experience whatsoever. After some research in other forums, I have discovered that the issue seems to occur with Atheros-Based cards only.
It looks like they appear as regular ethernet cards, not wireless, and that the IBM BIOS does not allow more than one of these.

Possible solutions:
a) bypass the check
b) make the BIOS think it is some other sort of device (possibly dangerous)

Also, could someone cross-post this in the anandtech forum to draw more peoples attention to this? Thanks!!!

LtTPfan · #2 Post by **LtTPfan** » Wed Jan 18, 2006 6:13 pm

I've been an assembly programmer since 1981, maybe I can help but too bad you didn't request earlier as I just started back to school and am not sure how much time I can devote.

The no1802 fix is far more benign than modding the BIOS. Personally, I'd prefer modding the card's eeprom as screwing up a card would only cost a few dollars to correct and wouldn't leave you with a useless system till corrected. There is some good info on this over at Anandtech; however, what I've seen has been Linux based, and pretty much Greek to me.

Can I assume the 01C9 error is for "too many ethernet controllers" and you were getting this in addition to the 1802 error before modding your BIOS (and without the no1802 fix)?

danage · #3 Post by **danage** » Thu Jan 19, 2006 3:27 am

Maybe there is time on a boring sunday afternoon? :)
I totally agree to that the 1802 patch is the most benign solution - my disappointment is living proof... Yes the 01C9 is the too many ethernet controllers. For some reason the BIOS thinks the Atheros wireless card is an ethernet controller too many.

Card EEPROM modding has some disadvantages:
a) It can only be done to cards that are similar in built - e.g. you cant mod an Atheros card to an Intel card because the windows drivers also rely on the device ID's.
b) Model limitations. There is an IBM card somewhat similar to the Atheros card I have - but that one isn't supported by my thinkpad model either (The device ID does not show up in the BIOS whitelist, I double checked). So modding this card (and many others) into an IBM brand would not help in a lot of cases. The T30 is not the latest model and a lot more cards are available now that at the time it was released. More proof of how bad a whitelist policy is.

So from all information gathered, best option seems to bypass both the 1802 and the 01C9 check. That would create a BIOS that would work no matter which wireless card you have. It's a lot riskier than just modding the PCI ID's, since you're actually messing with code.

You in?

LtTPfan · #4 Post by **LtTPfan** » Thu Jan 19, 2006 5:16 pm

I'm in but hopefully the 01C9 error can be fixed by setting a bit in EEPROM just like the 1802 fix does to avoid the check, rather than modding the BIOS, that would require modding for every family (T20, T30, etc) while the 1802 type fix would cover all but some of the newer models. We'd need a BIOS dump for at least one of those.

zone · #5 Post by **zone** » Fri Jan 20, 2006 8:45 am

danage wrote: -----------> THE 01C9 DIDN'T GO AWAY!!!

Same here, A31p with Atheros based Gigabyte GN-WIAG01 (Super AG) mini PCI. BTW after installing latest drivers (v1.11) from Gigabyte site card reports as GN-WPAG.

Card itself works perfectly for past half of year, also in Super G - 108Mbs mode with my Netgear WGT624 router, just cannot rid of 01C9 warning on POST.
Also, I didn't have to apply 1802.com hack since it seems that 1802 error is fixed at least on A31p with recent BIOS - ver. 1GET40WW (1.12).

01C9 is not big issue just big annoyance on otherwise great system.
So, hope that we'll figure out somehow how to get rid of it.

I'm in.

z
______________________________

A31p - 2.5GHz P4M, 1GB RAM, 60GB HDD, Gigabyte GN-WIAG01 (Atheros Super AG)

zone · #6 Post by **zone** » Fri Jan 20, 2006 9:20 am

zone wrote: Same here, A31p with Atheros based Gigabyte GN-WIAG01 (Super AG) mini PCI. BTW after installing latest drivers (v1.11) from Gigabyte site card reports as GN-WPAG.

At some point in order to bypass 01C9 I tryed also to install original IBM drivers for Atheros based cards - IBM 11a/b/g Wireless LAN Mini PCI Adapter and IBM 11a/b/g Wireless LAN Mini PCI Adapter II but IBM drivers weren't worked with my card.

z
______________________________

A31p - 2.5GHz P4M, 1GB RAM, 60GB HDD, Gigabyte GN-WIAG01 (Atheros Super AG)

danage · #7 Post by **danage** » Fri Jan 20, 2006 12:30 pm

I'm going to try to contact the guy who wrote the original 1802-mod. Maybe he knows something about the CMOS bits or can maybe get the information the same way he found out about the 1802-bit.

PLUS: If anybody is interested in a detailed guide on how to mod the BIOS I can post that. Just keep in mind it is of no use: It doesn't remove the 01C9, and the 1802 you can get rid of with no-1802.com

To ZONE: Changing the drivers will not help. The POST is at near-hardware level (BIOS= Basic Input Output System) and fully driver-independent.

LtTPfan · #8 Post by **LtTPfan** » Fri Jan 20, 2006 4:03 pm

danage wrote:I'm going to try to contact the guy who wrote the original 1802-mod. Maybe he knows something about the CMOS bits or can maybe get the information the same way he found out about the 1802-bit.

He might certainly be able to contribute some valuable information. BTW, I sent you a proggy I wrote to try out.

systemparadox · #9 Post by **systemparadox** » Fri Jan 20, 2006 4:05 pm

Ooo this looks promising. Just bought an Atheros card and am a bit annoyed that I have to press Esc every darn time.

Why doesn't the error come up when there is a card supplied by IBM in? What is it looking for?

Why on earth does it complain anyway?
Having more than one ethernet device is hardly a problem.

danage, I probably won't be able to help with this project, but can I have the detailed BIOS mod guide please?

Thanks
Simon

LtTPfan · #10 Post by **LtTPfan** » Fri Jan 20, 2006 5:39 pm

Detailed info on hacking the BIOS for the 1802 error can be found here: http://www.srcf.ucam.org/~mjg59/thinkpad/bios.html, and here:
http://www.paul.sladen.org/thinkpad-r31 ... i-ids.html

This however, will not effect the "too many ethernet controllers" issue. It is being worked on, though.

danage · #11 Post by **danage** » Sun Jan 22, 2006 4:25 am

Hello everybody just a quick update to tell you all about our progress: Wer'e trying to approach the issue from different angles at this point. Favor lies on a CMOS patch and we haven't gone to actually considering modifying the BIOS itself.

1) One attempt was switching the CMOS bits located close to the 1802-bit on and off in a trial-and-error manner. LtTPfan has coded a tool that would let me do this, and I have been trying various combinations ---> without luck, so far.

2) Next attempt was contacting the person who "invented" the no-1802.com patch. I have received mail from the guy who ported the no-1802 to linux including contact information to the original programmer. LtTPfan is on it, let the assembler guys speak :)

3) About modding the EEPROM: I just found this guide that tells how to mod a cards EEPROM so it looks like an IBM adapter. It can be done without a problem, but would result in Windows driver trouble. Note how the guy has to modify the Linux drivers as well! Plus, I doubt the 01C9 would go away, this error seems to be caused by another BIOS routine (one that checks for secondary ethernet adapters). So in my opinion, this option is not likely to be successful.

4) I've had another idea that could lead to discovery, but we would need someone with a T40 (or similar BIOS) for that. The T30 does not support ANY Atheros based WLAN card, I have confirmed that in my BIOS dump.
The only two cards supported are: IBM High Rate Wireless LAN Mini-PCI Adapter with Modem II and Cisco Aironet Wireless 802.11b featuring Agere/Cisco chipsets. Using ANY, even an IBM Atheros card should thus give you both the 1802 and 01C9 error.
The T40 on the other hand supports Atheros cards, e.g. the IBM 11a/b/g Wireless LAN Mini PCI Adapter, and with it gives neither the 1802 nor the 01C9 error.

Could someone with a T40 please confirm this information so I can investigate further?

Thanks! -Danage
PS. I am working on the BIOS mod instructions, give me a day or so.

danage · #12 Post by **danage** » Sun Jan 22, 2006 8:53 pm

The issue has been resolved. It will probably take a few days to wrap it all up into nice code, but all Atheros users rejoice - you can make the 01C9 error disappear. First off, I'd like to thank the contributors, namely LtTPfan who was in from the beginning and helped most, Borg Number One (a.k.a. Borg_No_One) from the German BIOS modder forum, Vojtech Pavlek, Christian L. from the German Thinkpad forum, mjg59 for his web info and finally Paul Sladen who today gave me on the IRC the final piece of information necessary to resolve the issue.

But here is the Hack: Surprise surprise, it is based on modding the card's EEPROM. I know, LtTPfan suggested this method in one of his first posts, and I have to admit that my disfavor of that idea was fully without reason as only Atheros cards produce the error. No messing with vendor and device ID is necessary. The drivers will still function.

The T30 BIOS conducts a scan for ethernet devices. It does this by reading the "PCI Class Codes" of every connected device. If more than one ethernet device is found, it produces the 01C9 error message. Unlike other wireless cards, which identify themselves as "other" network adapters, Atheros identify themselves as "ethernet". This collides with the internal ethernet controller (also a PCI device) and produces the 01C9.

The solution is very simple. All that is needed is to modify the Atheros EEPROM so that it correctly identifies itself as a "other network adapter" instead of ethernet. It's a one byte patch. I have done this in Linux with a modified tool that I found on the net. I will get in touch with the programmer to ask whether he will allow me to use it here. At the same time, I will ask LtTPfan to port it to DOS.

Finally, I would like to point out that this is NOT bad code or policy by IBM. It is probably more of a "misunderstanding". Other computers do not produce the error because they do not check the connected devices for conflicts as thoroughly as IBM does. It has nothing to do with the whitelist policy either, it's just a bad, bad, coincidence.

The final result will be posted in a new thread so people can discuss possible problems modding. Give us a day or two :)

wulu · #13 Post by **wulu** » Mon Jan 23, 2006 4:38 am

Great job danage!

I couldn't stop myself to give it a try, and it works like a charme.
My T30 is up running again without any error message.

Thanks

rfcroc · #14 Post by **rfcroc** » Thu Jan 26, 2006 9:28 pm

danage wrote: The T30 does not support ANY Atheros based WLAN card, I have confirmed that in my BIOS dump.
The only two cards supported are: IBM High Rate Wireless LAN Mini-PCI Adapter with Modem II and Cisco Aironet Wireless 802.11b featuring Agere/Cisco chipsets. Using ANY, even an IBM Atheros card should thus give you both the 1802 and 01C9 error.

I eagerly await the 1 bit fix (I'm holding onto my IBM Atheros based mini-PCI card and holding off installation (and the no-1802).)
Any news yet?

danage · #15 Post by **danage** » Fri Jan 27, 2006 1:36 am

Hello everybody, we're still on it. Sorry but it turns out providing a usable piece of software is more complicated than was expected. In Windows, probably a device driver would need to be coded to gain write access to PCI address space. The likelihood that's not going to happen is quite high, nonetheless LtTPFan is investigating.
The linux solution of course works, but since I know *beep* about programming cannot provide code that would at least come close to being safe for public use. Already got a slap from Paul Sladen for modifying code not by commenting out lines, but deleting them in the source. :)
I'll ask around with friends to find someone who could go over the linux code, and as soon as it's 'clean', this forum is going to know first...
You'll hear from us soon! -Danage

vincentfox · #16 Post by **vincentfox** » Mon Jan 30, 2006 4:12 pm

I actually have another ThinkPad running Linux. Could you give any pointers about this process? I would think to put the Atheros into the Linux TP to reprogram it, then move it back to the Windows X22.

danage · #17 Post by **danage** » Tue Jan 31, 2006 1:34 pm

hello everybody!

at this point, we are in need of additional information. i have not posted further instructions because the modification is somewhat risky. in order to provide a safe patch, we need supplemental details. please, everybody contribute. the more we know, the faster we can code a safe solution.

please send me private mail with the following info:
a) which type of card are you using that produces the 01C9 error
b) which chipset does it have (atheros...)
c) which ibm thinkpad are you using
d) what are the PCI codes of your card

here is how to obtain them in windows:
Right click on my computer, go to management, go to device manager, go to properties of your wireless adapter, select the tab "details", highlight the long strange looking line and press ctrl-c to copy the information to the clipboard.

then, paste the line into the private message you are sending me :)

thanks everybody!
danage

PS: Background info - The final software will much likely be based on an auto boot Linux which will make the modification ease and breeze.

Memphis · #18 Post by **Memphis** » Fri Feb 03, 2006 4:14 pm

@danage, just dropped you a pm with the requested details of my rig incl. Atheros-card.
Good Luck!
01C9 sucks!!!

vincentfox · #19 Post by **vincentfox** » Sat Feb 04, 2006 12:38 pm

So how is this project going?

Wishing I had just bought an Intel 2915 now....

danage · #20 Post by **danage** » Sun Feb 05, 2006 9:34 am

Solution available in this thread. Thanks all for your patience. Bug reports & all other sorts of discussion there, please!

dummkopf · #21 Post by **dummkopf** » Tue Feb 07, 2006 11:25 am

Can I run this remove01c9.bin under FreeBSD without burning that ISO? I have Linux ABI installed.

vincentfox · #22 Post by **vincentfox** » Tue Feb 07, 2006 11:41 am

I downloaded the ISO. When I attempt to load it into Nero Burning ROM it gives me a warning:

"The entered block size does not correspond to the image length. The block size may be wrong. Do you want to correct the value or ignore the problem?"

danage · #23 Post by **danage** » Tue Feb 07, 2006 2:06 pm

Please: all questions of this kind in the new thread.

p4s2wd · #24 Post by **p4s2wd** » Mon Sep 25, 2006 5:08 am

Danage,

Can you show us how to hack IBM's bios? I have a X30, I can get my machine's bios by using Phoenix WinPhflash.

danage · #25 Post by **danage** » Mon Sep 25, 2006 6:13 am

first a warning: it's dangerous. with my t30, the respective id's showed up several times in the image. thus, there is no safe way of telling what possible effects hex editing them will have.

flashing a corrupt bios image might break the system board to a state in which only desoldering the eeprom and manually (by means of an external device) rewriting it is going to restore operatibility.

secondly, newer systems (for the t4x i know for certain) compress the bios images, wheras in older images the files are just attached to each other in from what i understand a way somewhat similar to linux tarballs. before editing, make sure your bios isn't compressed.

all information it took me to do the mod i gathered from paul sladen and matthew garretts pages. they are referred and linked to in this thread, i believe. if the information given on those pages is not sufficient for you to do the actual mod, i highly recommend not attempting it.

maybe there is a solution to your problem that will work without having to modify the bios?

p4s2wd · #26 Post by **p4s2wd** » Tue Sep 26, 2006 3:28 am

danage wrote:first a warning: it's dangerous. with my t30, the respective id's showed up several times in the image. thus, there is no safe way of telling what possible effects hex editing them will have.

flashing a corrupt bios image might break the system board to a state in which only desoldering the eeprom and manually (by means of an external device) rewriting it is going to restore operatibility.

secondly, newer systems (for the t4x i know for certain) compress the bios images, wheras in older images the files are just attached to each other in from what i understand a way somewhat similar to linux tarballs. before editing, make sure your bios isn't compressed.

all information it took me to do the mod i gathered from paul sladen and matthew garretts pages. they are referred and linked to in this thread, i believe. if the information given on those pages is not sufficient for you to do the actual mod, i highly recommend not attempting it.

maybe there is a solution to your problem that will work without having to modify the bios?

Yes, you are right, I really do know it is dangerous. I have a atheros 5005gs card, it can't be written. What I think is try to modify BIOS to suite my card's PCI ID.
For under atheros 5004 card, it is good way to change the card's PCI ID as list from your bios's whitelist, but not change the device type from Ethernet to Other ethernet. It will not trouble you what ever when you load default setting from your bios.

danage · #27 Post by **danage** » Tue Sep 26, 2006 3:06 pm

p4s2wd wrote:What I think is try to modify BIOS to suite my card's PCI ID.

As indicated in my initial post, changing the PCI ID in the whitelist will not make the 01c9 disappear.
A solution based on the BIOS would need to modify the separate SUBSYSTEM ID checking routine. Without disassembly (decompiling), there is no safe way of doing this, since the respective data is only one byte. This short, it cannot be found by means of a hex editor, since it will occur a billion times within the bios.

Sorry.

p4s2wd · #28 Post by **p4s2wd** » Wed Sep 27, 2006 10:05 pm

danage wrote:
p4s2wd wrote:What I think is try to modify BIOS to suite my card's PCI ID.
As indicated in my initial post, changing the PCI ID in the whitelist will not make the 01c9 disappear.
A solution based on the BIOS would need to modify the separate SUBSYSTEM ID checking routine. Without disassembly (decompiling), there is no safe way of doing this, since the respective data is only one byte. This short, it cannot be found by means of a hex editor, since it will occur a billion times within the bios.

Sorry.

On my X30 with bios 1.09, I do really succeed resolved this issue by changing SUBSYS ID from 01060290 to 040811468. It does never complain any error message. Maybe you can try this way for testing.

ariipamsndotcom · #29 Post by **ariipamsndotcom** » Wed Dec 13, 2006 10:28 am

Hello. I appreciate everybodys time and effort.
I have a thinkpad t30 2366 82u. I will be installing a an Atheros Super G+xr wireless card which has the AR5005 GS Atheros 5th generation chipset. I have downloaded and burned the image listed on this discussion on to a CD. I hope that this would prevent the 1082 error and now the other one as well? Will this in fact correct both issues? Does this change the info on the card really and not on the laptop itself? The card is on its way and I just want to make sure all will be ok. Thanks.

teetee · #30 Post by **teetee** » Tue Jan 09, 2007 12:46 am

The error-fix bootable CD won't be able to fix 01C9 error on Atheros AR5004 and above chips including AR5005(GS).

Ref.:http://thinkwiki.org/wiki/Problem_with_ ... et_devices

T30 BIOS Hack possible - 01C9 ISSUE SOLVED!

T30 BIOS Hack possible - 01C9 ISSUE SOLVED!

PROGRESS REPORT

Re: PROGRESS REPORT

Need to make sure what I should do for my install

Who is online