“Hell By no means Ends On x86: The Hyperspace Story, Continued, Type Of”

When researching Phoenix Hyperspace for my highly upsetting post on the topic, it was onerous to keep away from information articles proclaiming that it had been bought off by Phoenix (after they gave up wholesale on their concept of constructing something apart from BIOSes) and acquired up by HP. Nonetheless, that is the place the path ended; makes an attempt to seek out out what, if something, HP had completed with it proved fruitless. That’s, till two days in the past.

---

When researching an solely tangentially associated topic (the Dell Latitude Z600, which runs a very completely different instant-on linux) I stumbled throughout a point out of HP QuickWeb, described as one other fast-booting Linux distro. Digging into this, I uncovered fairly a surprising quantity of data I had managed to overlook earlier than, on account of there being no standardized terminology for any of these items.

The invention course of on all of this occurred so rapidly that I do not actually wish to drag it out the best way I did within the earlier publish. As soon as I knew the terminology, it took me perhaps six hours to make it from starting to finish. The journey is much less vital than the vacation spot on this leg of the story, so let me simply summarize a lot of it, damaged up into Necessary Knowledge Nodes:

• HP did in truth purchase Hyperspace in late 2009 – however they did not do something with it instantly.

• Prior to the acquisition, they already had an instant-on Linux – one based mostly on Splashtop, beneath the identify QuickWeb.

• It is wonderful that I missed this, as a result of they bought it throughout their entire vary for a number of years. Netbooks (Mini 210), client machines (Envy 13/14), enterprise (Probook 4730s, 4530s, 4430s), government (Elitebook 8540w, 8440p) – and these are just a few examples. There have been many extra. I used to be capable of stroll into RePC the day after I discovered about this and stroll out with two machines that help it, that is how widespread it was.

• Laptops with QuickWeb help have a bit button with a globe icon that boots QuickWeb as a substitute of your regular OS. Notice that not all HPs with globe buttons can do it; on some, that button simply opens an online browser inside Home windows. There is no such thing as a approach to inform which is which. For example, the Elitebook 8460 and 8470 look precisely an identical, however solely the previous helps QuickWeb.

• A pair years after the acquisition (AFAICT) HP lastly determined to do one thing with Hyperspace: They quietly changed the present QuickWeb with one based mostly on Hyperspace, with no fanfare or announcement of any type. I can discover no info linking the 2 – the one approach I used to be capable of show this was by downloading two revisions of QuickWeb, extracting them, and discovering strings for Splashtop in a single and Hyperspace within the different.

• As with the opposite Hyperspace (and Splashtop) implementations I confirmed within the earlier publish, the precise OS is completly uninteresting. Actually, it does not even have the unholy host filesystem entry function, or the workplace suite, or the power to avoid wasting recordsdata in any respect. It is merely an online browser, Skype, an e-mail consumer, and a few information and stonks widgets.

• Moreover, HP didn’t base their implementation on Hyperspace Hybrid or Twin. It is the very fundamental model: a fast-boot Linux that dual-boots with Home windows.

• It’s not, nonetheless, a standard MBR-type dual-boot setup, neither is it utilizing Phoenix’s wacky hidden BEER partition desk nonsense. As an alternative, the OS is solely saved as recordsdata on a FAT32 partition referred to as HP_TOOLS; it isn’t even hidden, the person can see it in Home windows.

• Since this period of HP laptop computer had early UEFI, and UEFI can learn FAT32, they used customized firmware code to only search for a partition with that particular identify, then it finds “HP_TOOLSQuickWebQuickWeb.efi” and boot it. EFI is an enormous step in making the PC extra boring (good that means)

Okay, let’s have some footage.

That is the “globe” button. As famous, it does not imply a machine positively has QuickWeb.

That is Quickweb – particularly, a model I have never but been capable of find. That is from an previous weblog publish. It is clearly Splashtop-based, because it’s clearly branded within the screenshot, however it appears to be a lot nearer to the unique providing, with a widget based mostly “desktop” and quite a lot of bundled apps together with Skype, chat, e-mail, music and a photograph viewer. I discovered a pair different screenshots that make it clear that the latter two apps are nonetheless the horrible Adobe Flash crap that they have been promoting in 2009.

I’ve seen references in HPs docs to QuickWeb model numbers, however no clear rubric. I think that this model is “QuickWeb 1,” the following one is “QuickWeb 2”, and the Hyperspace model is “QuickWeb 3.”

The above is what I think was “QuickWeb 2.” It says model 1, however who is aware of whose numbering scheme that’s. It is nonetheless Splashtop-based, however HP has eliminated the branding. I used to be capable of set up it on a machine (EliteBook 8440p,) however it appears to have completely no options apart from an online browser – that is the sole UI. It seems to be an enormous downgrade, purpose unknown.

That is the Hyperspace model, which I believe is “QuickWeb 3.” Functionally, it is a center floor; it has Skype and e-mail, plus these widgets (which, once more, nonetheless work; I related to wifi and each the CNN and BBC headline widgets populated.) In any other case, it’s nonetheless very barebones, not a lot better than “QuickWeb 1” from the appears of issues.

As famous, there’s nothing price discussing in regards to the OSes themselves. It is principally simply fascinating that Hyperspace continued to have a life in any respect, and form of a disappointment that HP’s imaginative and prescient of its future did not embrace any of its superior implementations, and in reality did not even embrace the workplace suite or something that made it extra fascinating than Splashtop.

Anyway, let’s get into the new shit.

This Is The New Shit

Whereas investigating QuickWeb, I started discovering mentions of one thing referred to as FastLook. At first, it wasn’t clear if this was two names for a similar factor, however it turned obvious that QuickLook was a definite product, as a result of I discovered that sure fashions (e.g. EliteBook 8440p) had one other separate button for launching it.

Let me reiterate: Sure HP laptops have three energy buttons that launch completely different OSes. That slaps all on it is personal.

However what is Quicklook?

It isn’t an “OS.” It is a program. Actually – it seems to be “HP_TOOLSQuickLookQuickLook.efi”, a standalone EFI software. Usually you solely see these within the type of OS bootloaders, BIOS config utilities, or perhaps a really restricted motherboard/laptop computer vendor restoration or firmware flashing software. However EFI apps are simply binaries, and EFI is a restricted “OS” that gives a set of libraries, so you possibly can conceivably write many advanced applications to run within it.

HP determined to put in writing Outlook.

QuickLook is an e-mail and calendar app you can launch immediately as a substitute of booting a standard OS. I have to stress that, so far as I can inform, this isn’t Linux, this isn’t DOS, this isn’t something. This can be a bespoke standalone program, written in C (there are .c recordsdata talked about all all through the .EFI, which is only a Home windows-format .EXE with a special identify.) It leverages EFI’s fundamental mouse/keyboard/graphics APIs, like “Absolute Pointer Protocol” and “Graphics Output Protocol.”

To reiterate, as a result of I have to know you perceive: HP wrote an e-mail/calendar consumer fully from scratch that runs inside your system’s BIOS.

Once you press the QuickLook button (the left blue icon above; the fitting is QuickWeb), the machine powers on, POSTs, after which onerous code within the EFI firmware checks for an hooked up onerous drive with a partition referred to as HP_TOOLS, then boots straight into QuicklookQuickLook.EFI, after which that’s what is operating in your machine. Not Home windows, not Linux. Your PC is natively operating QuickLook.

So, how does it deal with networking, SMTP/IMAP, and all of the complexities of Outlook, with out really being Outlook? How does it learn and write to your .OST database in your principal NTFS partition with out risking corruption? Effectively, naturally, it does not. That is one other filthy hack.

Once you set up QuickLook, it installs a plugin for Outlook (solely supported on 2003 and 2007) which periodically, at a configurable interval, copies all the contents of your inbox and calendar to an XML file in HP_TOOLS. In case you ship an e-mail or edit a calendar occasion from QuickLook, it simply writes it to an XML file, and once you boot into Home windows once more, the Outlook plugin reads it and replicates these actions inside the actual person DB.

What I mentioned was a lie: HP did not reimplement Outlook in any respect. They wrote a generic e-mail and calendar app, then wrote an Outlook connector for it.

This has implications.

Once I first began Quicklook, it complained that there was no person information, and I needed to set up the Outlook plugin to repair that. However at this level, chances are you’ll be questioning: if it isn’t really touching the Outlook information file, then why will we even want Outlook, or Home windows in any respect? The reply, so far as I do know, is that you do not – and HP does not even declare that you just do.

HP gives a document explaining how QuickLook works, which incorporates directions on how you can construct the HP_TOOLS partition manually and populate it with the wanted recordsdata. There is no such thing as a declare that you just should set this up utilizing their official installer.

I have never tried but, however I am unable to consider a purpose you could not do that from Linux, by merely making the partition and copying the recordsdata over. They don’t seem to be “blessed.” There aren’t any secret MBR entries. EFI is trendy software program, not a taped collectively pile of shit based mostly on code from 1983 that solely barely understands x64 and thinks it is booting from a floppy drive or a cassette port. It is aware of what AHCI is! It may possibly simply learn the fucking filesystem! It does not want a hand up from some absurd preboot bodgery. This entire factor is only a bunch of recordsdata.

As well as, the info recordsdata aren’t advanced:

There may be nothing stopping you from writing your individual script that reads a mail file from the rest – Thunderbird, or pine – and produces these recordsdata. QuickLook should not care.

Not, in fact, that you just’d WANT to make use of QuickLook. It does not boot that a lot quicker than a contemporary OS on an SSD. These days, it is totally pointless, and moreover, it runs like shit.

Whereas UEFI is “an working system” for a lot of intents and functions… it isn’t a really good one. Its APIs are very restricted and unoptimized, and that is most likely why the UI updates at perhaps 10fps. The mouse cursor does not even transfer easily. It actually appears and looks like crap, and that is almost certainly as a result of HP’s devs needed to write their very own widget set, there is no 2D graphics acceleration, no multithreading, and the API could not even enable entry to the framebuffer besides by way of extraordinarily crude, unoptimized full-screen updates.

Consider how the BIOS config in your motherboard from 2012 carried out, then think about making an attempt to make use of that as an working system. Oof. So similar to Splashtop and Hyperspace, it is pointless, however it is neat – although sadly not as neat because the absurd ACPI horseshit from the final publish.

Nonetheless, I had not but reached the top of my discoveries.

Deeper, extra sinful acts, for much less payoff

I used to be capable of set up QuickLook and QuickWeb on the machines I purchased by merely downloading them from HP’s driver website. Bless them, type of. However whereas looking for a selected model for a specific machine, I noticed a hyperlink to a obtain for one thing referred to as “HP DayStarter.” The outline was… regarding.

The HP DayStarter shows Microsoft Outlook calendar info and customized messages whereas Home windows hundreds on supported pocket book fashions with supported working programs.

My response was “I am sorry. What,” and it kinda nonetheless is.

I discovered this screenshot:

Daystarter purports to point out you your calendar whereas Home windows is booting. And, okay, so what – they’re simply changing the bootsplash picture, like all of us did on Home windows 98 and XP once we have been 13.

No. It steps by way of your week because it boots. And you’ll hit keyboard shortcuts to pause or clear it. This can be a program that runs whereas Home windows boots.

I do not… actually… want to elucidate that this is not attainable. As-written: no, this is not a factor, this cannot be completed, and I do not simply imply “it is onerous and messy,” I imply this shouldn’t be attainable.

I’m no programs programmer (nor have I handed the bar) however I do know a bit bit. The second any Home windows based mostly on NT begins booting, the system is in protected mode. Because the identify suggests, it is a safety function, to stop applications from doing issues that endanger the reliability of the system.

As quickly because the Home windows kernel begins executing, it has complete dominion over the PC. Nothing else is allowed to run – nothing else can run. The CPU is executing solely the Home windows kernel code. If the rest makes an attempt to put in writing to system reminiscence – such because the VGA framebuffer – with out the kernel’s permission, it might end in a hardware-level exception, which the kernel would entice and discard.

I am overstating the purpose nonetheless. It does not matter that one thing else could not contact system reminiscence, as a result of there’s simply merely no approach to execute different code. At this level within the boot course of, your laptop is sort of a MOS 6502 from 1979. It is a Turing machine. Every byte of machine code from the Home windows kernel is executed so as, it does precisely what Microsoft coded it to do, after which the instruction pointer both advances or jumps to a different location that the Home windows kernel chooses.

There aren’t any cracks into which to get your fingers. It is like asking “what if my hand handed by way of this brick wall, how would we deal with that situation?” It isn’t going to occur as a result of it is logically inconceivable.

So I put in QuickLook and rebooted the laptop computer.

Holy fucking hell. They actually did it, the madmen. However how. Fucking how did they do that, when it must be bodily inconceivable?

The primary reply that involves thoughts is “they hacked the OS”, however A) it might immediately get reverted by Microsoft SFC, B) it might immediately break as quickly as you put in any OS patches, and C) nah. Simply nah. HP didn’t write a program that binary-patches NTOSKRNL.COM. That is not even on the desk.

However… what else is left? What might they probably have completed to perform this?

In case you can consider this: It is worse than Hyperspace Twin.

We do not have full documentation on how this works, however now we have sufficient to assemble a working idea.

What we do know is that the Quicklook plugin for outlook creates a DayStarter folder on HP_TOOLS, and each time a sync happens, it reads your calendar and spits out 7 JPEG recordsdata. For example:

This is likely one of the recordsdata it generated. These, once more, are merely recordsdata within the FAT32 filesystem.

Once you allow HP Daystarter (it is a setting within the BIOS setup), I consider that there’s a piece of onerous code within the firmware that prompts. In different phrases, this isn’t an EFI software being loaded off the HDD like QuickWeb and QuickLook. There is not any “Daystarter.efi”, and that is smart – for those who booted into that, you would not be booting Home windows.

Perhaps it is chainloading into Home windows? Effectively, this machine shipped with Home windows 7, which did not even get UEFI help till very late in its lifespan. It was nearly definitely shipped in UEFI-CSM mode (aka BIOS mode,) and that is the way it’s engaged on my specimen. So they would not have the ability to launch an EFI app, then chainload right into a BIOS app – no less than, all of the common bootloaders I’ve tried declare that that is inconceivable, and I am positive if that wasn’t the case they might be prepared to do it.

The idea partly recommended by mxshift (who is not on right here, however we chat on discord and so they do x86 firmware programming) is that Daystarter will get loaded by HP’s EFI (i assume earlier than it goes to CSM mode) and traps a sure interrupt or IO entry. As Home windows is beginning, it retains updating the VGA framebuffer to maneuver the progress bar. Daystarter traps that occasion, throws it away, and as a substitute writes its personal content material to the framebuffer. It additionally makes use of this chance to examine the keyboard buffer for an F4 or F3, so it may possibly take person enter.

However wait – how is that code operating? Home windows is in protected mode at this level, what could be allowed to supersede it?

Per the slide reproduced above: Daystarter runs from goddamn System Administration Mode.

I had by no means heard of SMM earlier than at the moment. Apparently this was launched on the 386SL CPU (supposedly, to implement software-based thermal administration options) and operates with a privilege degree even greater than ring 0 (the place the Home windows kernel lives) with entry to do just about something. It is a well-guarded function, apparently, however hey – HP writes their very own firmware. They will do regardless of the hell they need.

So Daystarter is – naturally! – a horrifying abuse of a {hardware} function not meant for this in any respect. I am advised SMM has been leveraged earlier than for a lot of issues it wasn’t meant for, such because the implementation of USB legacy keyboard help, however this feels prefer it’s simply not justified.

As a result of, let’s be actual right here: That is absurd! That is all so fucking absurd!

The one silly lever you possibly can pull

I’ve this lengthy operating idea about laptop {hardware} producers: They’re depressing, and terrified.

I’ve written many occasions, from completely different angles, about what I believe capitalism sees in Expertise as a complete. The fundamental loop has been the identical for over a century:

• Invent a factor

• Persuade a gaggle of individuals (hopefully “everybody”) that it’ll make them happier

• Make a number of revenue by promoting individuals your vacuum cleaner

• MARKET SATURATION! Everybody has a vacuum and no one wants a brand new one.

• Invent a brand new vacuum with a stronger motor OR a quieter motor OR an extended hose OR a greater beater OR lighter weight

• Make a number of revenue by promoting individuals your new vacuum; they throw out their previous one.

Now have a look at PCs, from the attitude of a vendor like HP or Dell:

• Assemble a factor out of components you had nothing to do with: an Intel CPU and chipset, Realtek audio, nVidia GPU, and so forth

• Persuade a gaggle of folks that yours is the most cost effective or most dependable

• Make a number of revenue by promoting individuals the very same factor your competitors has

This can be a a lot more durable row to hoe. The entire latter a part of the loop is lacking. How does Dell persuade you that their machine has a brand new greeble, a brand new button, a brand new lever? They cannot. It is inconceivable for them so as to add one, the PC does not work that approach. The fundamental motherboard has to be wired up precisely the identical approach in each single machine on the earth; all capabilities past fundamental CPU, reminiscence and boot need to be offered by standardized parts – USB, PCIe, or m.2. They have to work the identical as all others of their sort.

Which means that Dell cannot promote you a machine with a function that is not simply a PCIe card or a USB system. Positive, perhaps they might invent a tool that makes use of these interfaces and refuse to promote it by way of another channels besides with their PCs – however I problem you to provide you with such a tool that A) could be so compelling that it might make somebody purchase a Dell simply to have it, and B) would not be cloned as a generic product per week later. It is inconceivable.

It is even worse for motherboard distributors. All these corporations are is turnkeys. They take the Intel socket of the month, Intel chipset of the month, and whichever different jellybean components are present and glue them collectively. Is it straightforward? In all probability not, however no one cares.

Yeah, individuals have all the time had opinions. They’d say “all Gigabyte boards are trash” – it is patent nonsense, and everyone knows it. Folks used Gigabyte or Abit or ECS boards for years with no actual bother. Typically a nasty chipset got here out, just like the nForce, however that wasn’t the board mfgr’s fault. The one factor they ever actually fucked up was the capacitor state of affairs, and also you higher BELIEVE the distributors all rode THAT shit when it was lastly acknowledged as an actual downside. There have been (and I believe nonetheless are) motherboard bins with MASSIVE wordart textual content proclaiming JAPANESE POLYMER CAPS because the highest-billed function.

As a result of, yeah – what the hell else can a motherboard vendor provide? They don’t seem to be allowed to do something! Their board HAS to work precisely the identical as all others or it is ineffective trash. And the way might they add any performance anyway? They’re basically promoting you the center of a machine. All of the components you bolt on see it as a black field that is imagined to work a really particular approach. It is logically inconceivable for something the motherboard does to have an effect on how the pc works; it is merely a junction field.

Within the mid 2000s, Abit and ASUS and MSI have been going batshit. They could not work out what to do – the marketplace for DIY PCs was enormous, most likely even moreso than now, however the one levers they’d entry to tug have been thermal administration and overclocking – so that you higher consider they rode it as onerous as they’ll. That is once we began getting these grotesque, screen-filling overclocking apps with gallons of Graphic Design dumped on them; enormous digital gauges making an attempt to show “adjusting a voltage rail by .01V” into Some Matrix Shit.

It is also when Asus bought no less than one board with an entire 5.25″ entrance drive bay panel devoted to resetting your CMOS settings.

Yeah, I do know, I do know. Overclockers did want to try this lots. However that is not why ASUS made such an enormous deal out of it. It was this nice massive army-green panel with warning stripes and a molly cowl over the change. Asus was so fucking pumped that they lastly obtained to show the one precise perform their board had. Motherboards cannot have buttons! This was the one one that would ever exist, and for 15 years it solely obtained pressed as soon as each 5 years. Asus have been beside themselves that they lastly obtained to have a function.

I noticed CMOS reset switches dressed up in so some ways, as a result of that is all they’d. And when EFI got here alongside and gave motherboard distributors one thing, something in any respect to customise, they ate it up. Each single motherboard has a very completely different (and uniquely unnavigable) CMOS setup as a result of, once more, that is the one lever they’ll pull.

So, evaluating to the state of affairs in query:

Think about being a product designer at HP, within the very bizarre 12 months of 2010, and having some fucking VP storm in and go “We now have to ship Options for Executives. We’re promoting $1500 notebooks to them, however Dell has precisely the identical set of ins and outs as us. We’d like Options.”

You simply stare on the man, and slowly go, “We’re… a motherboard. That is all we’re, Bob. We will not have options. The whole lot that occurs as soon as the pc is on is inside Home windows, and we aren’t allowed to the touch it.”

And Bob tells you you are fucking fired, and turns to the following particular person and says the identical factor. He repeats this till somebody blurts out the dumbest concept anybody’s ever had, and Bob goes “That is it, make that.”

What do executives do on their computer systems? Outlook. It is the one program they run. It is why you possibly can’t promote them something – what, extra RAM? Outlook runs nice in two gigs, even now, particularly then. Extra CPU energy? Identical reply. A GPU? To do what? And that is all a pc producer can do – stick in additional jellybean components that another person made.

How do you make a pc by some means higher at Outlook? The reply is you can’t, it is inconceivable. Home windows controls the entire machine and Microsoft controls Outlook, HP cannot stick their fingers in and by some means improve the Outlook expertise. So, they touched the one factor that Microsoft did not management: The pre-boot expertise.

Does it make sense to put in writing a complete separate OS, simply so an government does not have to attend an additional 30 seconds to see their e-mail? After all not. This was additionally 2011, and SSDs existed. It might have price much less to only bundle an SSD, and would have labored higher. Sleep and hibernate have been additionally fairly practical by then. It might have been, and nearly definitely was, quicker to only put your machine to sleep and wake it up usually. However no, we want a function. So HP wrote one of many solely standalone EFI purposes in existence.

After which they have been out of concepts. Quasi-Outlook can now load in 15 seconds! Uh. Now what? What’s left to assault?

Effectively… what in the event that they are meaning to get into Home windows? We will not pace that up (on a 5400rpm spinning disk that our completely oblivious cost-reduction specialists pressured us to incorporate) – so what if we have been capable of no less than show their calendar 15 seconds sooner?

Was this price it? Value inventing fully new types of software program, price injecting code into the fucking thermal administration layer that overrides components of the Home windows boot sequence and dangers corrupting principal RAM and rendering the machine unusable, all for a fucking 15 second speedup? After all not. However it is the one lever they might pull, and it is higher than getting fired as a result of your place, and your small business, and the corporate you’re employed for, have been redundant for a decade.