Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Tisheng Chen]

In recent IBM thinkpad systems, there is a limit to
allowed MiniPCI wireless cards. When an unauthorized
card is plugged in, the system doesn't boot and
halt with an error message like:

ERROR
1802: Unauthorized network card is plugged in
Power off and remove the miniPCI network card.

I met this 1802 error problem several months ago, and
since then my wifi card was used in a very clumsy and
inconvenient way. I used to boot to LILO menu or
Windows system first, then suspend and plug
in the card. After that, when the system is awake, the
card is working.

Recently, I learned two solutions to attack this
problem. One is to crack the BIOS by modifying the
PCI_ID list of allowed cards in the BIOS, as
suggested by Paul Sladen and Matthew Garrett.
(Reference:
http://www.paul.sladen.org/thinkpad-r31/wifi-card-pci-ids.html)

The other way is unbelievably simple. There is a byte
in CMOS which controls whether an "unauthorized" card
is allowed or not. That's 0x6a, actually only
the bit 0x80. The program to unlock the authorization
mechanism is like (asm):

MOV     DX,0070
MOV     AL,6A
OUT     DX,AL
MOV     DX,0071
IN      AL,DX
OR      AL,80
OUT     DX,AL
MOV     AX,4C00
INT     21

The program can be downloaded from:
  http://jcnp.pku.edu.cn/~shadow/1802/no-1802.com
To use this program, you need to boot to DOS.

The CMOS solution is safe, but I'm not sure that it
works for all recent thinkpads and all cards. The BIOS
crack sure does, however it is difficult
and dangerous.

Sincerely,
Tisheng



	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

Re: Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Vojtech Pavlik]

On Sun, Jun 13, 2004 at 12:39:50AM -0700, Tisheng Chen wrote:

> In recent IBM thinkpad systems, there is a limit to
> allowed MiniPCI wireless cards. When an unauthorized
> card is plugged in, the system doesn't boot and
> halt with an error message like:
> 
> ERROR
> 1802: Unauthorized network card is plugged in
> Power off and remove the miniPCI network card.

[snip]

> The other way is unbelievably simple. There is a byte
> in CMOS which controls whether an "unauthorized" card
> is allowed or not. That's 0x6a, actually only
> the bit 0x80. The program to unlock the authorization
> mechanism is like (asm):
> 
> MOV     DX,0070
> MOV     AL,6A
> OUT     DX,AL
> MOV     DX,0071
> IN      AL,DX
> OR      AL,80
> OUT     DX,AL
> MOV     AX,4C00
> INT     21
> 
> The program can be downloaded from:
>   http://jcnp.pku.edu.cn/~shadow/1802/no-1802.com
> To use this program, you need to boot to DOS.
> 
> The CMOS solution is safe, but I'm not sure that it
> works for all recent thinkpads and all cards. The BIOS
> crack sure does, however it is difficult
> and dangerous.

Well, here is a version for Linux:

------------------------------------------------------------

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(void)
{
	int fd;
	unsigned char data;

	printf("Disabling WiFi whitelist check.\n");
	fd = open("/dev/nvram", O_RDWR);
	lseek(fd, 0x6a, SEEK_SET);
	read(fd, &data, 1);
	printf("CMOS address 0x6a: %02x->", data);
	data &= ~0x80;
	printf("%02x\n", data);
	lseek(fd, 0x6a, SEEK_SET);
	write(fd, &data, 1);
	close(fd);
	printf("Done.\n");
}

------------------------------------------------------------

I've tried it on my ThinkPad X31, but it doesn't work at all. The CMOS
has a value 0xfa at the offset 0x6a, so the most upper bit is already
set.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Tisheng Chen]

In linux, there is only 114 bytes in /dev/nvram, not
128. The correct address is not 0x6a, but 0x5c. You
can try it with "inb" and "outb".

In T30, the original value of the control byte is
0x01, which needs to be set to 0x81.

And "data &= ~0x80;" is incorrect. It should be "data
|=0x80" or "data^=0x80", I think.

Somebody did succeed with a X31. 
As I know, it should works for T30,R40,X31,R40E at
least.

Tisheng

--- Vojtech Pavlik <vojtech@suse.cz> wrote:
> On Sun, Jun 13, 2004 at 12:39:50AM -0700, Tisheng
> Chen wrote:
> 
> > In recent IBM thinkpad systems, there is a limit
> to
> > allowed MiniPCI wireless cards. When an
> unauthorized
> > card is plugged in, the system doesn't boot and
> > halt with an error message like:
> > 
> > ERROR
> > 1802: Unauthorized network card is plugged in
> > Power off and remove the miniPCI network card.
> 
> [snip]
> 
> > The other way is unbelievably simple. There is a
> byte
> > in CMOS which controls whether an "unauthorized"
> card
> > is allowed or not. That's 0x6a, actually only
> > the bit 0x80. The program to unlock the
> authorization
> > mechanism is like (asm):
> > 
> > MOV     DX,0070
> > MOV     AL,6A
> > OUT     DX,AL
> > MOV     DX,0071
> > IN      AL,DX
> > OR      AL,80
> > OUT     DX,AL
> > MOV     AX,4C00
> > INT     21
> > 
> > The program can be downloaded from:
> >   http://jcnp.pku.edu.cn/~shadow/1802/no-1802.com
> > To use this program, you need to boot to DOS.
> > 
> > The CMOS solution is safe, but I'm not sure that
> it
> > works for all recent thinkpads and all cards. The
> BIOS
> > crack sure does, however it is difficult
> > and dangerous.
> 
> Well, here is a version for Linux:
> 
>
------------------------------------------------------------
> 
> #include <stdio.h>
> #include <sys/types.h>
> #include <unistd.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> 
> int main(void)
> {
> 	int fd;
> 	unsigned char data;
> 
> 	printf("Disabling WiFi whitelist check.\n");
> 	fd = open("/dev/nvram", O_RDWR);
> 	lseek(fd, 0x6a, SEEK_SET);
> 	read(fd, &data, 1);
> 	printf("CMOS address 0x6a: %02x->", data);
> 	data &= ~0x80;
> 	printf("%02x\n", data);
> 	lseek(fd, 0x6a, SEEK_SET);
> 	write(fd, &data, 1);
> 	close(fd);
> 	printf("Done.\n");
> }
> 
>
------------------------------------------------------------
> 
> I've tried it on my ThinkPad X31, but it doesn't
> work at all. The CMOS
> has a value 0xfa at the offset 0x6a, so the most
> upper bit is already
> set.
> 
> -- 
> Vojtech Pavlik
> SuSE Labs, SuSE CR
> 




	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/ 

Re: Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Vojtech Pavlik]

On Sun, Jun 13, 2004 at 12:10:29PM -0700, Tisheng Chen wrote:

> In linux, there is only 114 bytes in /dev/nvram, not
> 128. The correct address is not 0x6a, but 0x5c. You
> can try it with "inb" and "outb".

I thought the data at the end were missing. If it's data at the
beginning, that makes sense then.

> In T30, the original value of the control byte is
> 0x01, which needs to be set to 0x81.

OK.

> And "data &= ~0x80;" is incorrect. It should be "data
> |=0x80" or "data^=0x80", I think.

My mistake. I tried clearing the bit instead of setting it, which made
my X31 unbootable until I restored default CMOS settings.

> Somebody did succeed with a X31. 

Good to know.

> As I know, it should works for T30,R40,X31,R40E at
> least.

I'll try.

> Tisheng
> 
> --- Vojtech Pavlik <vojtech@suse.cz> wrote:
> > On Sun, Jun 13, 2004 at 12:39:50AM -0700, Tisheng
> > Chen wrote:
> > 
> > > In recent IBM thinkpad systems, there is a limit
> > to
> > > allowed MiniPCI wireless cards. When an
> > unauthorized
> > > card is plugged in, the system doesn't boot and
> > > halt with an error message like:
> > > 
> > > ERROR
> > > 1802: Unauthorized network card is plugged in
> > > Power off and remove the miniPCI network card.
> > 
> > [snip]
> > 
> > > The other way is unbelievably simple. There is a
> > byte
> > > in CMOS which controls whether an "unauthorized"
> > card
> > > is allowed or not. That's 0x6a, actually only
> > > the bit 0x80. The program to unlock the
> > authorization
> > > mechanism is like (asm):
> > > 
> > > MOV     DX,0070
> > > MOV     AL,6A
> > > OUT     DX,AL
> > > MOV     DX,0071
> > > IN      AL,DX
> > > OR      AL,80
> > > OUT     DX,AL
> > > MOV     AX,4C00
> > > INT     21
> > > 
> > > The program can be downloaded from:
> > >   http://jcnp.pku.edu.cn/~shadow/1802/no-1802.com
> > > To use this program, you need to boot to DOS.
> > > 
> > > The CMOS solution is safe, but I'm not sure that
> > it
> > > works for all recent thinkpads and all cards. The
> > BIOS
> > > crack sure does, however it is difficult
> > > and dangerous.
> > 
> > Well, here is a version for Linux:
> > 
> >
> ------------------------------------------------------------
> > 
> > #include <stdio.h>
> > #include <sys/types.h>
> > #include <unistd.h>
> > #include <sys/stat.h>
> > #include <fcntl.h>
> > 
> > int main(void)
> > {
> > 	int fd;
> > 	unsigned char data;
> > 
> > 	printf("Disabling WiFi whitelist check.\n");
> > 	fd = open("/dev/nvram", O_RDWR);
> > 	lseek(fd, 0x6a, SEEK_SET);
> > 	read(fd, &data, 1);
> > 	printf("CMOS address 0x6a: %02x->", data);
> > 	data &= ~0x80;
> > 	printf("%02x\n", data);
> > 	lseek(fd, 0x6a, SEEK_SET);
> > 	write(fd, &data, 1);
> > 	close(fd);
> > 	printf("Done.\n");
> > }
> > 
> >
> ------------------------------------------------------------
> > 
> > I've tried it on my ThinkPad X31, but it doesn't
> > work at all. The CMOS
> > has a value 0xfa at the offset 0x6a, so the most
> > upper bit is already
> > set.
> > 
> > -- 
> > Vojtech Pavlik
> > SuSE Labs, SuSE CR
> > 
> 
> 
> 
> 
> 	
> 		
> __________________________________
> Do you Yahoo!?
> Friends.  Fun.  Try the all-new Yahoo! Messenger.
> http://messenger.yahoo.com/ 
> 

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Vojtech Pavlik]

On Sun, Jun 13, 2004 at 12:10:29PM -0700, Tisheng Chen wrote:

> Somebody did succeed with a X31. 
> As I know, it should works for T30,R40,X31,R40E at
> least.

Indeed, this version:

#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>

int main(void)
{
	int fd;
	unsigned char data;

	printf("Disabling WiFi whitelist check.\n");
	fd = open("/dev/nvram", O_RDWR);
	lseek(fd, 0x5c, SEEK_SET);
	read(fd, &data, 1);
	printf("CMOS address 0x5c: %02x->", data);
	data |= 0x80;
	printf("%02x\n", data);
	lseek(fd, 0x5c, SEEK_SET);
	write(fd, &data, 1);
	close(fd);
	printf("Done.\n");
}

worked just fine, and the notebook no longer complains about an
unsupported WiFi card! Now if I only can get the card to enable the
transmitter/receiver. It's a Compaq Atheros card inside an X31 notebook.

-- 
Vojtech Pavlik
SuSE Labs, SuSE CR

Re: Solution to the "1802: Unauthorized network card" problem in recent thinkpad systems

[Tisheng Chen]

If you can't find a driver for linux, try ndiswrapper
driver or linuxant's driverloader. However, the later
one is not free.

websites:
http://ndiswrapper.sf.net
http://www.linuxant.com/driverloader/

--- Vojtech Pavlik <vojtech@suse.cz> wrote:
> On Sun, Jun 13, 2004 at 12:10:29PM -0700, Tisheng
> Chen wrote:
> 
> > Somebody did succeed with a X31. 
> > As I know, it should works for T30,R40,X31,R40E at
> > least.
> 
> Indeed, this version:
> 
> #include <stdio.h>
> #include <sys/types.h>
> #include <unistd.h>
> #include <sys/stat.h>
> #include <fcntl.h>
> 
> int main(void)
> {
> 	int fd;
> 	unsigned char data;
> 
> 	printf("Disabling WiFi whitelist check.\n");
> 	fd = open("/dev/nvram", O_RDWR);
> 	lseek(fd, 0x5c, SEEK_SET);
> 	read(fd, &data, 1);
> 	printf("CMOS address 0x5c: %02x->", data);
> 	data |= 0x80;
> 	printf("%02x\n", data);
> 	lseek(fd, 0x5c, SEEK_SET);
> 	write(fd, &data, 1);
> 	close(fd);
> 	printf("Done.\n");
> }
> 
> worked just fine, and the notebook no longer
> complains about an
> unsupported WiFi card! Now if I only can get the
> card to enable the
> transmitter/receiver. It's a Compaq Atheros card
> inside an X31 notebook.
> 
> -- 
> Vojtech Pavlik
> SuSE Labs, SuSE CR
> 



	
		
__________________________________
Do you Yahoo!?
Friends.  Fun.  Try the all-new Yahoo! Messenger.
http://messenger.yahoo.com/