mirror of
https://github.com/chipsec/chipsec
synced 2026-06-08 13:31:00 +00:00
Nathaniel Mitchell
182 lines
7.7 KiB
Python
182 lines
7.7 KiB
Python
# CHIPSEC: Platform Security Assessment Framework
|
|
# Copyright (c) 2010-2021, Intel Corporation
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU General Public License
|
|
# as published by the Free Software Foundation; Version 2.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
#
|
|
# Contact information:
|
|
# chipsec@intel.com
|
|
#
|
|
|
|
"""
|
|
Access to physical memory
|
|
|
|
usage:
|
|
>>> read_physical_mem( 0xf0000, 0x100 )
|
|
>>> write_physical_mem( 0xf0000, 0x100, buffer )
|
|
>>> write_physical_mem_dowrd( 0xf0000, 0xdeadbeef )
|
|
>>> read_physical_mem_dowrd( 0xfed40000 )
|
|
"""
|
|
|
|
from struct import unpack, pack
|
|
from typing import Any, Dict, Tuple, Optional
|
|
from chipsec.hal.hal_base import HALBase
|
|
from chipsec.library.logger import print_buffer_bytes
|
|
from chipsec.library.bits import make_mask
|
|
|
|
|
|
class Memory(HALBase):
|
|
def __init__(self, cs):
|
|
super(Memory, self).__init__(cs)
|
|
self.helper = cs.helper
|
|
|
|
####################################################################################
|
|
#
|
|
# Physical memory API using 64b Physical Address
|
|
# (Same functions as below just using 64b PA instead of High and Low 32b parts of PA)
|
|
#
|
|
####################################################################################
|
|
|
|
# Reading physical memory
|
|
|
|
def read_physical_mem(self, phys_address: int, length: int) -> bytes:
|
|
self.logger.log_hal(f'[mem] 0x{phys_address:016X}')
|
|
return self.helper.read_phys_mem(phys_address, length)
|
|
|
|
def read_physical_mem_qword(self, phys_address: int) -> int:
|
|
out_buf = self.read_physical_mem(phys_address, 8)
|
|
value = unpack('=Q', out_buf)[0]
|
|
self.logger.log_hal(f'[mem] qword at PA = 0x{phys_address:016X}: 0x{value:016X}')
|
|
return value
|
|
|
|
def read_physical_mem_dword(self, phys_address: int) -> int:
|
|
out_buf = self.read_physical_mem(phys_address, 4)
|
|
value = unpack('=I', out_buf)[0]
|
|
self.logger.log_hal(f'[mem] dword at PA = 0x{phys_address:016X}: 0x{value:08X}')
|
|
return value
|
|
|
|
def read_physical_mem_word(self, phys_address: int) -> int:
|
|
out_buf = self.read_physical_mem(phys_address, 2)
|
|
value = unpack('=H', out_buf)[0]
|
|
self.logger.log_hal(f'[mem] word at PA = 0x{phys_address:016X}: 0x{value:04X}')
|
|
return value
|
|
|
|
def read_physical_mem_byte(self, phys_address: int) -> int:
|
|
out_buf = self.read_physical_mem(phys_address, 1)
|
|
value = unpack('=B', out_buf)[0]
|
|
self.logger.log_hal(f'[mem] byte at PA = 0x{phys_address:016X}: 0x{value:02X}')
|
|
return value
|
|
|
|
# Writing physical memory
|
|
|
|
def write_physical_mem(self, phys_address: int, length: int, buf: bytes) -> int:
|
|
if self.logger.HAL:
|
|
self.logger.log(f'[mem] buffer len = 0x{length:X} to PA = 0x{phys_address:016X}')
|
|
print_buffer_bytes(buf)
|
|
return self.helper.write_phys_mem(phys_address, length, buf)
|
|
|
|
def write_physical_mem_dword(self, phys_address: int, dword_value: int) -> int:
|
|
self.logger.log_hal(f'[mem] dword to PA = 0x{phys_address:016X} <- 0x{dword_value:08X}')
|
|
return self.write_physical_mem(phys_address, 4, pack('I', dword_value))
|
|
|
|
def write_physical_mem_word(self, phys_address: int, word_value: int) -> int:
|
|
self.logger.log_hal(f'[mem] word to PA = 0x{phys_address:016X} <- 0x{word_value:04X}')
|
|
return self.write_physical_mem(phys_address, 2, pack('H', word_value))
|
|
|
|
def write_physical_mem_byte(self, phys_address: int, byte_value: int) -> int:
|
|
self.logger.log_hal(f'[mem] byte to PA = 0x{phys_address:016X} <- 0x{byte_value:02X}')
|
|
return self.write_physical_mem(phys_address, 1, pack('B', byte_value))
|
|
|
|
# Allocate physical memory buffer
|
|
|
|
def alloc_physical_mem(self, length: int, max_phys_address: int = 0xFFFFFFFFFFFFFFFF) -> Tuple[int, int]:
|
|
(va, pa) = self.helper.alloc_phys_mem(length, max_phys_address)
|
|
self.logger.log_hal(f'[mem] Allocated: PA = 0x{pa:016X}, VA = 0x{va:016X}')
|
|
return (va, pa)
|
|
|
|
def va2pa(self, va: int) -> Optional[int]:
|
|
(pa, error_code) = self.helper.va2pa(va)
|
|
if error_code:
|
|
self.logger.log_hal(f'[mem] Looks like VA (0x{va:016X}) not mapped')
|
|
return None
|
|
self.logger.log_hal(f'[mem] VA (0x{va:016X}) -> PA (0x{pa:016X})')
|
|
return pa
|
|
|
|
# Map physical address to virtual
|
|
|
|
def map_io_space(self, pa: int, length: int, cache_type: int) -> int:
|
|
va = self.helper.map_io_space(pa, length, cache_type)
|
|
self.logger.log_hal(f'[mem] Mapped: PA = 0x{pa:016X}, VA = 0x{va:016X}')
|
|
return va
|
|
|
|
# Free physical memory buffer
|
|
|
|
def free_physical_mem(self, pa: int) -> bool:
|
|
ret = self.helper.free_phys_mem(pa)
|
|
self.logger.log_hal(f'[mem] Deallocated : PA = 0x{pa:016X}')
|
|
return True if ret == 1 else False
|
|
|
|
def set_mem_bit(self, addr: int, bit: int) -> int:
|
|
addr += bit >> 3
|
|
byte = self.read_physical_mem_byte(addr)
|
|
self.write_physical_mem_byte(addr, (byte | (0x1 << (bit & 0x7))))
|
|
return byte
|
|
|
|
# reference: https://github.com/tianocore/edk2/blob/c4fdec0a83d69bd0399b1b4351fa9c3af3c6fd65/UefiCpuPkg/Library/MtrrLib/MtrrLib.c#L816
|
|
def get_max_memory_bit_size(self):
|
|
CPU_EXTENDED_FUNCTION = 0x80000000
|
|
CPU_VIR_PHY_ADDRESS_SIZE = 0x80000008
|
|
CPUID_SIG = 0
|
|
CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS = 0x7
|
|
NONINTEL_DEFAULT_MAX_PA_SIZE = 36
|
|
MSR_IA32_TME_ACTIVATE = 0x982
|
|
MSR_TME_ACTIVATE_ENABLED_BIT = 1
|
|
MSR_TME_ACTIVATE_ENABLED_BIT_SIZE = 1
|
|
MSR_TME_ACTIVATE_MKTME_KEYID_BIT = 32
|
|
MSR_TME_ACTIVATE_MKTME_KEYID_BIT_SIZE = 4
|
|
phys_address_size = 0
|
|
DEFAULT_THREAD_ID = 0
|
|
eax, _, _, _ = self.helper.cpuid(CPU_EXTENDED_FUNCTION, 0)
|
|
if eax >= CPU_VIR_PHY_ADDRESS_SIZE:
|
|
eax, _, _, _ = self.helper.cpuid(CPU_VIR_PHY_ADDRESS_SIZE, 0)
|
|
phys_address_size = self.get_value_from_bit_def(eax, 0, 8)
|
|
else:
|
|
phys_address_size = NONINTEL_DEFAULT_MAX_PA_SIZE # If not defined in CPUID, assume size 36 and non-standard Intel CPU
|
|
max_func, _, _, _ = self.helper.cpuid(CPUID_SIG, 0)
|
|
if max_func >= 0x7:
|
|
_, _, ex_feature, _ = self.helper.cpuid(CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS, 0)
|
|
ex_func = self.get_value_from_bit_def(ex_feature, 13, 1)
|
|
if ex_func == 1:
|
|
tme_active = self.helper.read_msr(DEFAULT_THREAD_ID, MSR_IA32_TME_ACTIVATE)
|
|
if self.get_value_from_bit_def(tme_active, MSR_TME_ACTIVATE_ENABLED_BIT, MSR_TME_ACTIVATE_ENABLED_BIT_SIZE) > 0:
|
|
phys_address_size -= self.get_value_from_bit_def(tme_active, MSR_TME_ACTIVATE_MKTME_KEYID_BIT, MSR_TME_ACTIVATE_MKTME_KEYID_BIT_SIZE)
|
|
return phys_address_size
|
|
|
|
def get_max_memory_mask(self):
|
|
size = self.get_max_memory_bit_size()
|
|
return make_mask(size)
|
|
|
|
|
|
def get_value_from_bit_def(self, inputValue, fieldStartBit, fieldSize):
|
|
return (inputValue >> fieldStartBit) & self.get_bit_mask(fieldSize)
|
|
|
|
def get_def(self, range_name: str) -> Dict[str, Any]:
|
|
'''Return address access of a MEM register'''
|
|
ranges = self.cs.Cfg.get_objlist(range_name)
|
|
if ranges:
|
|
return ranges[0]
|
|
return None
|
|
|
|
|
|
haldata = {"arch":[HALBase.MfgIds.Any], 'name': {'memory': "Memory"}}
|