PCI ID '0x15c0' has no known signatures.

[d0ntrash]

Hi Björn,

I tried the tool on a firmware I just dumped from a ThinkPad T470. The parse command seems to work, but it cannot find a signature for ID 0x15c0.

python tcfp.py parse /media/sf_VM_Share/test.bin -v
2020-11-27 16:32:10,414 - DEBUG - Found PCI ID: 0x15c0 ('JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016]')
2020-11-27 16:32:10,415 - DEBUG - Parsing DROM.
2020-11-27 16:32:10,415 - DEBUG - Done parsing DROM.
2020-11-27 16:32:10,415 - WARNING - PCI ID '0x15c0' has no known signatures. Ignoring PCI ID and trying all patterns instead.
2020-11-27 16:32:10,415 - DEBUG - [0] Heuristics match:
2020-11-27 16:32:10,415 - DEBUG - pci-id : JHL6540 Thunderbolt 3 Bridge (C step) [Alpine Ridge 4C 2016] (0x15d3)
2020-11-27 16:32:10,415 - DEBUG - sl : 1
2020-11-27 16:32:10,415 - DEBUG - sig : [{'offset': 0x0, 'value': b'\x00'}, {'offset': 0x800, 'value': b'\x19'}]
2020-11-27 16:32:10,415 - DEBUG - patch : None
2020-11-27 16:32:10,415 - DEBUG - [1] Heuristics match:
2020-11-27 16:32:10,415 - DEBUG - pci-id : JHL6340 Thunderbolt 3 Bridge (C step) [Alpine Ridge 2C 2016] (0x15da)
2020-11-27 16:32:10,415 - DEBUG - sl : 1
2020-11-27 16:32:10,415 - DEBUG - sig : [{'offset': 0x800, 'value': b'\x19'}]
2020-11-27 16:32:10,415 - DEBUG - patch : [{'offset': 0x800, 'value': b'\x18'}]
Vendor ID : 0x109
PCI ID : 0x15c0
PCI Device Name : JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016]
Model ID : 0x1601
NVM version : 4 (0x4)
Vendor : LENOVO
Device : T470
Image type : Full
Security Level : SL1

When I try to use the patch command, it fails:

python tcfp.py patch /media/sf_VM_Share/test.bin -v     
2020-11-27 15:42:05,253 - DEBUG - Found PCI ID: 0x15c0 ('JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016]')
2020-11-27 15:42:05,253 - DEBUG - Parsing DROM.
2020-11-27 15:42:05,253 - DEBUG - Done parsing DROM.
2020-11-27 15:42:05,253 - WARNING - PCI ID '0x15c0' has no known signatures. Ignoring PCI ID and trying all patterns instead.
2020-11-27 15:42:05,254 - DEBUG - [0] Heuristics match:
2020-11-27 15:42:05,254 - DEBUG - pci-id : JHL6540 Thunderbolt 3 Bridge (C step) [Alpine Ridge 4C 2016] (0x15d3)
2020-11-27 15:42:05,254 - DEBUG - sl : 1
2020-11-27 15:42:05,254 - DEBUG - sig : [{'offset': 0x0, 'value': b'\x00'}, {'offset': 0x800, 'value': b'\x19'}]
2020-11-27 15:42:05,254 - DEBUG - patch : None
2020-11-27 15:42:05,254 - DEBUG - [1] Heuristics match:
2020-11-27 15:42:05,255 - DEBUG - pci-id : JHL6340 Thunderbolt 3 Bridge (C step) [Alpine Ridge 2C 2016] (0x15da)
2020-11-27 15:42:05,255 - DEBUG - sl : 1
2020-11-27 15:42:05,255 - DEBUG - sig : [{'offset': 0x800, 'value': b'\x19'}]
2020-11-27 15:42:05,255 - DEBUG - patch : [{'offset': 0x800, 'value': b'\x18'}]
Vendor ID : 0x109
PCI ID : 0x15c0
PCI Device Name : JHL6240 Thunderbolt 3 Bridge (Low Power) [Alpine Ridge LP 2016]
Model ID : 0x1601
NVM version : 4 (0x4)
Vendor : LENOVO
Device : T470
Image type : Full
Security Level : SL1

Error while processing firmware image:  PCI ID unsupported, but current SL detected through heuristics. No patch pattern available for this SL signature. Aborting.

Is it possible to add the patch pattern for this specific PCI ID? If yes i would be happy to help.

This is the Firmware I dumped. dump.zip

[BjornRuytenberg]

Hi Konstantin,

Thanks for your contribution!

Could you share a dump of the firmware state after setting SL0 in your BIOS? Patching certain offsets to alter Security Levels may cause some unwanted side effects, such as TB power management and connectivity issues. While these may not show on your particular configuration (NVM version + controller model), I'd like to do some quick checks to help ensure these won't happen when other users apply the pattern from your PR onto their configuration.

Btw, if you're feeling adventurous -- it would be nice if you could also have a look at patching from SL2 and SL3 states ;-).

[d0ntrash]

Here you go. dump.zip This includes dumps for SL 0,2 and 3.

I will add patching support for SL2 and SL3 as soon as I got some spare time :)