From d8fe4431ec7e158be1267ecece8d7d338a4b9703 Mon Sep 17 00:00:00 2001 From: Philipp Deppenwiese Date: Fri, 18 Mar 2016 00:52:54 +0100 Subject: util/intelmetool: Add intelmetool from Damien Zammit The intelmetool shows information about the Intel Management Engine for different platforms. Original source code can be found under following link: https://github.com/zamaudio/intelmetool.git Change-Id: I0eb17833a21eb04cf9245a7312289a4102bec1a9 Signed-off-by: Philipp Deppenwiese Reviewed-on: https://review.coreboot.org/14136 Tested-by: build bot (Jenkins) Reviewed-by: Martin Roth --- util/intelmetool/intelmetool.c | 369 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 369 insertions(+) create mode 100644 util/intelmetool/intelmetool.c (limited to 'util/intelmetool/intelmetool.c') diff --git a/util/intelmetool/intelmetool.c b/util/intelmetool/intelmetool.c new file mode 100644 index 0000000000..bde32041ff --- /dev/null +++ b/util/intelmetool/intelmetool.c @@ -0,0 +1,369 @@ +/* intelmetool Dump interesting things about Management Engine even if hidden + * Copyright (C) 2014 Damien Zammit + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; version 2 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + +#include +#include +#include +#include +#include + +#ifdef __NetBSD__ +#include +#endif + +#include "me.h" +#include "mmap.h" +#include "intelmetool.h" + +#define FD2 0x3428 +#define ME_COMMAND_DELAY 10000 + +extern int fd_mem; +int debug = 0; + +static uint32_t fd2 = 0; +static const int size = 0x4000; +static volatile uint8_t *rcba; + +static void dumpmem(uint8_t *phys, uint32_t size) +{ + uint32_t i; + printf("Dumping cloned ME memory:\n"); + for (i = 0; i < size; i++) { + printf("%02X",*((uint8_t *) (phys + i))); + } + printf("\n"); +} + +static void zeroit(uint8_t *phys, uint32_t size) +{ + uint32_t i; + for (i = 0; i < size; i++) { + *((uint8_t *) (phys + i)) = 0x00; + } +} + +static void dumpmemfile(uint8_t *phys, uint32_t size) +{ + FILE *fp = fopen("medump.bin", "w"); + uint32_t i; + for (i = 0; i < size; i++) { + fprintf(fp, "%c", *((uint8_t *) (phys + i))); + } + fclose(fp); +} + +static void rehide_me() { + if (fd2 & 0x2) { + printf("Re-hiding MEI device..."); + fd2 = *(uint32_t *)(rcba + FD2); + *(uint32_t *)(rcba + FD2) = fd2 | 0x2; + printf("done, "); + } +} + +/* You need >4GB total ram, in kernel cmdline, use 'mem=1000m' + * then this code will clone to absolute memory address 0xe0000000 + * which can be read using a mmap tool at that offset. + * Real ME memory is located around top of memory minus 64MB. (I think) + * so we avoid cloning to this part. + */ +static void dump_me_memory() { + uint32_t me_clone = 0x60000000; + uint8_t *dump; + + dump = map_physical_exact(me_clone, me_clone, 0x2000000); + zeroit(dump, 0x2000000); + printf("Send magic command for memory clone\n"); + + mei_reset(); + usleep(ME_COMMAND_DELAY); + void* ptr = &me_clone; + int err = mkhi_debug_me_memory(ptr); + + if (!err) { + printf("Wait a second..."); + usleep(ME_COMMAND_DELAY); + printf("done\n\nHere are the first bytes:\n"); + dumpmemfile(dump, 0x2000000); + //printf("Try reading 0x%zx with other mmap tool...\n" + // "Press enter to quit, you only get one chance to run this tool before reboot required for some reason\n", me_clone); + while (getc(stdin) != '\n') {}; + unmap_physical(dump, 0x2000000); + } +} + +static int pci_platform_scan() { + struct pci_access *pacc; + struct pci_dev *dev; + char namebuf[1024], *name; + + pacc = pci_alloc(); + pacc->method = PCI_ACCESS_I386_TYPE1; + + pci_init(pacc); + pci_scan_bus(pacc); + + for (dev=pacc->devices; dev; dev=dev->next) { + pci_fill_info(dev, PCI_FILL_IDENT | PCI_FILL_BASES | PCI_FILL_SIZES | PCI_FILL_CLASS); + name = pci_lookup_name(pacc, namebuf, sizeof(namebuf), + PCI_LOOKUP_DEVICE, dev->vendor_id, dev->device_id); + if (dev->vendor_id == 0x8086) { + if (PCI_DEV_HAS_ME_DISABLE(dev->device_id)) { + printf(CGRN "Good news, you have a `%s` so ME is present but can be disabled, continuing...\n\n" RESET, name); + break; + } else if (PCI_DEV_HAS_ME_DIFFICULT(dev->device_id)) { + printf(CRED "Bad news, you have a `%s` so you have ME hardware on board and you can't control or disable it, continuing...\n\n" RESET, name); + break; + } else if (PCI_DEV_CAN_DISABLE_ME_IF_PRESENT(dev->device_id)) { + printf(CYEL "Not sure if ME hardware is present because you have a `%s`, but it is possible to disable it if you do, continuing...\n\n" RESET, name); + break; + } else if (PCI_DEV_ME_NOT_SURE(dev->device_id)) { + printf(CYEL "Found `%s`. Not sure whether you have ME hardware, exiting\n\n" RESET, name); + pci_cleanup(pacc); + return 1; + break; + } + } + } + + if (!PCI_DEV_HAS_ME_DISABLE(dev->device_id) && + !PCI_DEV_HAS_ME_DIFFICULT(dev->device_id) && + !PCI_DEV_CAN_DISABLE_ME_IF_PRESENT(dev->device_id) && + !PCI_DEV_ME_NOT_SURE(dev->device_id)) { + printf(CCYN "ME is not present on your board or unkown\n\n" RESET); + pci_cleanup(pacc); + return 1; + } + + pci_cleanup(pacc); + + return 0; +} + +static struct pci_dev *pci_me_interface_scan(char **name) { + struct pci_access *pacc; + struct pci_dev *dev; + char namebuf[1024]; + + pacc = pci_alloc(); + pacc->method = PCI_ACCESS_I386_TYPE1; + + pci_init(pacc); + pci_scan_bus(pacc); + + for (dev=pacc->devices; dev; dev=dev->next) { + pci_fill_info(dev, PCI_FILL_IDENT | PCI_FILL_BASES | PCI_FILL_SIZES | PCI_FILL_CLASS); + *name = pci_lookup_name(pacc, namebuf, sizeof(namebuf), + PCI_LOOKUP_DEVICE, dev->vendor_id, dev->device_id); + if (dev->vendor_id == 0x8086) { + if (PCI_DEV_HAS_SUPPORTED_ME(dev->device_id)) { + break; + } + } + } + + if (!PCI_DEV_HAS_SUPPORTED_ME(dev->device_id)) { + rehide_me(); + + printf("MEI device not found\n"); + pci_cleanup(pacc); + return NULL; + } + + return dev; +} + +static int activate_me() { + struct pci_access *pacc; + struct pci_dev *sb; + uint32_t rcba_phys; + + pacc = pci_alloc(); + pacc->method = PCI_ACCESS_I386_TYPE1; + + pci_init(pacc); + pci_scan_bus(pacc); + + sb = pci_get_dev(pacc, 0, 0, 0x1f, 0); + if (!sb) { + printf("Uh oh, southbridge not on BDF(0:31:0), please report this error, exiting.\n"); + pci_cleanup(pacc); + return 1; + } + pci_fill_info(sb, PCI_FILL_IDENT | PCI_FILL_BASES | PCI_FILL_SIZES | PCI_FILL_CLASS); + + rcba_phys = pci_read_long(sb, 0xf0) & 0xfffffffe; + rcba = map_physical(rcba_phys, size); + + //printf("RCBA at 0x%08" PRIx32 "\n", (uint32_t)rcba_phys); + fd2 = *(uint32_t *)(rcba + FD2); + *(uint32_t *)(rcba + FD2) = fd2 & ~0x2; + if (fd2 & 0x2) { + printf("MEI was hidden on PCI, now unlocked\n"); + } else { + printf("MEI not hidden on PCI, checking if visible\n"); + } + + pci_cleanup(pacc); + + return 0; +} + +static void dump_me_info() { + struct pci_dev *dev; + uint32_t stat, stat2; + char *name; + + if (pci_platform_scan()) { + exit(1); + } + + dev = pci_me_interface_scan(&name); + if (!dev) { + exit(1); + } + + if (activate_me()) { + exit(1); + } + + printf("MEI found: [%x:%x] %s\n\n", dev->vendor_id, dev->device_id, name); + stat = pci_read_long(dev, 0x40); + printf("ME Status : 0x%x\n", stat); + stat2 = pci_read_long(dev, 0x48); + printf("ME Status 2 : 0x%x\n\n", stat2); + + intel_me_status(stat, stat2); + printf("\n"); + intel_me_extend_valid(dev); + printf("\n"); + + if ((stat & 0xf000) >> 12 != 0) { + printf("ME: has a broken implementation on your board with this BIOS\n"); + } + + intel_mei_setup(dev); + usleep(ME_COMMAND_DELAY); + mei_reset(); + usleep(ME_COMMAND_DELAY); + mkhi_get_fw_version(); + usleep(ME_COMMAND_DELAY); + mei_reset(); + usleep(ME_COMMAND_DELAY); + mkhi_get_fwcaps(); + usleep(ME_COMMAND_DELAY); + + rehide_me(); + + munmap((void*)rcba, size); +} + +static void print_version(void) +{ + printf("intelmetool v%s -- ", INTELMETOOL_VERSION); + printf("Copyright (C) 2015 Damien Zammit\n\n"); + printf( + "This program is free software: you can redistribute it and/or modify\n" + "it under the terms of the GNU General Public License as published by\n" + "the Free Software Foundation, version 2 of the License.\n\n" + "This program is distributed in the hope that it will be useful,\n" + "but WITHOUT ANY WARRANTY; without even the implied warranty of\n" + "MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n" + "GNU General Public License for more details.\n\n"); +} + +static void print_usage(const char *name) +{ + printf("usage: %s [-vh?sd]\n", name); + printf("\n" + " -v | --version: print the version\n" + " -h | --help: print this help\n\n" + " -s | --show: dump all me information on console\n" + " -d | --debug: enable debug output\n" + "\n"); + exit(1); +} + +int main(int argc, char *argv[]) +{ + int opt, option_index = 0; + unsigned cmd_exec = 0; + + static struct option long_options[] = { + {"version", 0, 0, 'v'}, + {"help", 0, 0, 'h'}, + {"show", 0, 0, 's'}, + {"debug", 0, 0, 'd'}, + {0, 0, 0, 0} + }; + + while ((opt = getopt_long(argc, argv, "vh?sd", + long_options, &option_index)) != EOF) { + switch (opt) { + case 'v': + print_version(); + exit(0); + break; + case 's': + cmd_exec = 1; + break; + case 'd': + debug = 1; + break; + case 'h': + case '?': + default: + print_usage(argv[0]); + exit(0); + break; + } + } + + #if defined(__FreeBSD__) + if (open("/dev/io", O_RDWR) < 0) { + perror("/dev/io"); + #elif defined(__NetBSD__) + # ifdef __i386__ + if (i386_iopl(3)) { + perror("iopl"); + # else + if (x86_64_iopl(3)) { + perror("iopl"); + # endif + #else + if (iopl(3)) { + perror("iopl"); + #endif + printf("You need to be root.\n"); + exit(1); + } + + #ifndef __DARWIN__ + if ((fd_mem = open("/dev/mem", O_RDWR)) < 0) { + perror("Can not open /dev/mem"); + exit(1); + } + #endif + + switch(cmd_exec) { + case 1: + dump_me_info(); + break; + default: + print_usage(argv[0]); + break; + } + + return 0; +} -- cgit v1.2.3