Add ich_descriptor_tool to decode all flash descriptors stored in a flash dump file

This patch adds an external utility that shares most of the existing descriptor
decoding source code. Additionally to what is available via FDOC/FDOD this
allows to access:
 - the softstraps which are used to configure the chipset by flash content
   without the need for BIOS routines. on ICH8 it is possible to read those
   with FDOC/FDOC too, but this was removed in later chipsets.
 - the ME VSCC (Vendor Specific Component Capabilities) table. simply put,
   this is an SPI chip database used to figure out the flash's capabilities.
 - the MAC address stored in the GbE image.

Intel thinks this information should be confidential for ICH9 and up, but
references some tidbits in their public documentation.
This patch includes the human-readable information for ICH8, Ibex Peak
(5 series) and Cougar Point (6 series); the latter two were obtained from
leaked "SPI Flash Programming Guides" found by google. Data regarding ICH9
and...

ich_descriptors.h

@@ -227,22 +227,349 @@ struct ich_desc_master {
 	};
 };
 
+#ifdef ICH_DESCRIPTORS_FROM_DUMP
+struct ich_desc_north_strap {
+	union {
+		uint32_t STRPs[1]; /* current maximum: ich8 */
+		struct { /* ich8 */
+			struct { /* STRP2 (in the datasheet) */
+				uint32_t MDB			:1,
+								:31;
+			};
+		} ich8;
+	};
+};
+
+struct ich_desc_south_strap {
+	union {
+		uint32_t STRPs[16]; /* current maximum: ibex peak */
+		struct { /* ich8 */
+			struct { /* STRP1 */
+				uint32_t ME_DISABLE		:1,
+								:6,
+					 TCOMODE		:1,
+					 ASD			:7,
+					 BMCMODE		:1,
+								:3,
+					 GLAN_PCIE_SEL		:1,
+					 GPIO12_SEL		:2,
+					 SPICS1_LANPHYPC_SEL	:1,
+					 MESM2SEL		:1,
+								:1,
+					 ASD2			:7;
+			};
+		} ich8;
+		struct { /* ibex peak */
+			struct { /* STRP0 */
+				uint32_t			:1,
+					 cs_ss2			:1,
+								:5,
+					 SMB_EN			:1,
+					 SML0_EN		:1,
+					 SML1_EN		:1,
+					 SML1FRQ		:2,
+					 SMB0FRQ		:2,
+					 SML0FRQ		:2,
+								:4,
+					 LANPHYPC_GP12_SEL	:1,
+					 cs_ss1			:1,
+								:2,
+					 DMI_REQID_DIS		:1,
+								:4,
+					 BBBS			:2,
+								:1;
+			};
+			struct { /* STRP1 */
+				uint32_t cs_ss3			:4,
+								:28;
+			};
+			struct { /* STRP2 */
+				uint32_t			:8,
+					 MESMASDEN		:1,
+					 MESMASDA		:7,
+								:8,
+					 MESMI2CEN		:1,
+					 MESMI2CA		:7;
+			};
+			struct { /* STRP3 */
+				uint32_t			:32;
+			};
+			struct { /* STRP4 */
+				uint32_t PHYCON			:2,
+								:6,
+					 GBEMAC_SMBUS_ADDR_EN	:1,
+					 GBEMAC_SMBUS_ADDR	:7,
+								:1,
+					 GBEPHY_SMBUS_ADDR	:7,
+								:8;
+			};
+			struct { /* STRP5 */
+				uint32_t			:32;
+			};
+			struct { /* STRP6 */
+				uint32_t			:32;
+			};
+			struct { /* STRP7 */
+				uint32_t MESMA2UDID_VENDOR	:16,
+					 MESMA2UDID_DEVICE	:16;
+			};
+			struct { /* STRP8 */
+				uint32_t			:32;
+			};
+			struct { /* STRP9 */
+				uint32_t PCIEPCS1		:2,
+					 PCIEPCS2		:2,
+					 PCIELR1		:1,
+					 PCIELR2		:1,
+					 DMILR			:1,
+								:1,
+					 PHY_PCIEPORTSEL	:3,
+					 PHY_PCIE_EN		:1,
+								:20;
+			};
+			struct { /* STRP10 */
+				uint32_t			:1,
+					 ME_BOOT_FLASH		:1,
+					 cs_ss5			:1,
+					 VE_EN			:1,
+								:4,
+					 MMDDE			:1,
+					 MMADDR			:7,
+					 cs_ss7			:1,
+								:1,
+					 ICC_SEL		:3,
+					 MER_CL1		:1,
+								:10;
+			};
+			struct { /* STRP11 */
+				uint32_t SML1GPAEN		:1,
+					 SML1GPA		:7,
+								:16,
+					 SML1I2CAEN		:1,
+					 SML1I2CA		:7;
+			};
+			struct { /* STRP12 */
+				uint32_t			:32;
+			};
+			struct { /* STRP13 */
+				uint32_t			:32;
+			};
+			struct { /* STRP14 */
+				uint32_t			:8,
+					 VE_EN2			:1,
+								:5,
+					 VE_BOOT_FLASH		:1,
+								:1,
+					 BW_SSD			:1,
+					 NVMHCI_EN		:1,
+								:14;
+			};
+			struct { /* STRP15 */
+				uint32_t			:3,
+					 cs_ss6			:2,
+								:1,
+					 IWL_EN			:1,
+								:1,
+					 t209min		:2,
+								:22;
+			};
+		} ibex;
+		struct { /* cougar point */
+			struct { /* STRP0 */
+				uint32_t			:1,
+					 cs_ss1			:1,
+								:5,
+					 SMB_EN			:1,
+					 SML0_EN		:1,
+					 SML1_EN		:1,
+					 SML1FRQ		:2,
+					 SMB0FRQ		:2,
+					 SML0FRQ		:2,
+								:4,
+					 LANPHYPC_GP12_SEL	:1,
+					 LINKSEC_DIS		:1,
+								:2,
+					 DMI_REQID_DIS		:1,
+								:4,
+					 BBBS			:2,
+								:1;
+			};
+			struct { /* STRP1 */
+				uint32_t cs_ss3			:4,
+								:4,
+					 cs_ss2			:1,
+								:28;
+			};
+			struct { /* STRP2 */
+				uint32_t			:8,
+					 MESMASDEN		:1,
+					 MESMASDA		:7,
+					 MESMMCTPAEN		:1,
+					 MESMMCTPA		:7,
+					 MESMI2CEN		:1,
+					 MESMI2CA		:7;
+			};
+			struct { /* STRP3 */
+				uint32_t			:32;
+			};
+			struct { /* STRP4 */
+				uint32_t PHYCON			:2,
+								:6,
+					 GBEMAC_SMBUS_ADDR_EN	:1,
+					 GBEMAC_SMBUS_ADDR	:7,
+								:1,
+					 GBEPHY_SMBUS_ADDR	:7,
+								:8;
+			};
+			struct { /* STRP5 */
+				uint32_t			:32;
+			};
+			struct { /* STRP6 */
+				uint32_t			:32;
+			};
+			struct { /* STRP7 */
+				uint32_t MESMA2UDID_VENDOR	:16,
+					 MESMA2UDID_DEVICE	:16;
+			};
+			struct { /* STRP8 */
+				uint32_t			:32;
+			};
+			struct { /* STRP9 */
+				uint32_t PCIEPCS1		:2,
+					 PCIEPCS2		:2,
+					 PCIELR1		:1,
+					 PCIELR2		:1,
+					 DMILR			:1,
+					 cs_ss4			:1,
+					 PHY_PCIEPORTSEL	:3,
+					 PHY_PCIE_EN		:1,
+								:2,
+					 SUB_DECODE_EN		:1,
+								:7,
+					 PCHHOT_SML1ALERT_SEL	:1,
+								:9;
+			};
+			struct { /* STRP10 */
+				uint32_t			:1,
+					 ME_BOOT_FLASH		:1,
+								:6,
+					 MDSMBE_EN		:1,
+					 MDSMBE_ADD		:7,
+								:2,
+					 ICC_SEL		:3,
+					 MER_CL1		:1,
+					 ICC_PRO_SEL		:1,
+					 Deep_SX_EN		:1,
+					 ME_DBG_LAN		:1,
+								:7;
+			};
+			struct { /* STRP11 */
+				uint32_t SML1GPAEN		:1,
+					 SML1GPA		:7,
+								:16,
+					 SML1I2CAEN		:1,
+					 SML1I2CA		:7;
+			};
+			struct { /* STRP12 */
+				uint32_t			:32;
+			};
+			struct { /* STRP13 */
+				uint32_t			:32;
+			};
+			struct { /* STRP14 */
+				uint32_t			:32;
+			};
+			struct { /* STRP15 */
+				uint32_t cs_ss6			:6,
+					 IWL_EN			:1,
+					 cs_ss5			:2,
+								:4,
+					 SMLINK1_THERM_SEL	:1,
+					 SLP_LAN_GP29_SEL	:1,
+								:16;
+			};
+			struct { /* STRP16 */
+				uint32_t			:32;
+			};
+			struct { /* STRP17 */
+				uint32_t ICML			:1,
+					 cs_ss7			:1,
+								:30;
+			};
+		} cougar;
+	};
+};
+
+struct ich_desc_upper_map {
+	union {
+		uint32_t FLUMAP1;		/* Flash Upper Map 1 */
+		struct {
+			uint32_t VTBA	:8,	/* ME VSCC Table Base Address */
+				 VTL	:8,	/* ME VSCC Table Length */
+					:16;
+		};
+	};
+	struct {
+		union {		/* JEDEC-ID Register */
+			uint32_t JID;
+			struct {
+				uint32_t vid	:8, /* Vendor ID */
+					 cid0	:8, /* Component ID 0 */
+					 cid1	:8, /* Component ID 1 */
+						:8;
+			};
+		};
+		union {		/* Vendor Specific Component Capabilities */
+			uint32_t VSCC;
+			struct {
+				uint32_t ubes	:2, /* Upper Block/Sector Erase Size */
+					 uwg	:1, /* Upper Write Granularity */
+					 uwsr	:1, /* Upper Write Status Required */
+					 uwews	:1, /* Upper Write Enable on Write Status */
+						:3,
+					 ueo	:8, /* Upper Erase Opcode */
+					 lbes	:2, /* Lower Block/Sector Erase Size */
+					 lwg	:1, /* Lower Write Granularity */
+					 lwsr	:1, /* Lower Write Status Required */
+					 lwews	:1, /* Lower Write Enable on Write Status */
+						:3,
+					 leo	:16; /* Lower Erase Opcode */
+			};
+		};
+	} vscc_table[128];
+};
+#endif /* ICH_DESCRIPTORS_FROM_DUMP */
+
 struct ich_descriptors {
 	struct ich_desc_content content;
 	struct ich_desc_component component;
 	struct ich_desc_region region;
 	struct ich_desc_master master;
+#ifdef ICH_DESCRIPTORS_FROM_DUMP
+	struct ich_desc_north_strap north;
+	struct ich_desc_south_strap south;
+	struct ich_desc_upper_map upper;
+#endif /* ICH_DESCRIPTORS_FROM_DUMP */
 };
 
-void prettyprint_ich_descriptors(enum ich_chipset, const struct ich_descriptors *desc);
+void prettyprint_ich_descriptors(enum ich_chipset cs, const struct ich_descriptors *desc);
 
 void prettyprint_ich_descriptor_content(const struct ich_desc_content *content);
 void prettyprint_ich_descriptor_component(const struct ich_descriptors *desc);
 void prettyprint_ich_descriptor_region(const struct ich_descriptors *desc);
 void prettyprint_ich_descriptor_master(const struct ich_desc_master *master);
 
+#ifdef ICH_DESCRIPTORS_FROM_DUMP
+
+void prettyprint_ich_descriptor_upper_map(const struct ich_desc_upper_map *umap);
+void prettyprint_ich_descriptor_straps(enum ich_chipset cs, const struct ich_descriptors *desc);
+int read_ich_descriptors_from_dump(const uint32_t *dump, unsigned int len, struct ich_descriptors *desc);
+
+#else /* ICH_DESCRIPTORS_FROM_DUMP */
+
 int read_ich_descriptors_via_fdo(void *spibar, struct ich_descriptors *desc);
 int getFCBA_component_density(const struct ich_descriptors *desc, uint8_t idx);
 
+#endif /* ICH_DESCRIPTORS_FROM_DUMP */
 #endif /* __ICH_DESCRIPTORS_H__ */
 #endif /* defined(__i386__) || defined(__x86_64__) */

programmer.h

@@ -527,7 +527,6 @@ int default_spi_write_256(struct flashctx *flash, uint8_t *buf, unsigned int sta
 int register_spi_programmer(const struct spi_programmer *programmer);
 
 /* ichspi.c */
-#if CONFIG_INTERNAL == 1
 enum ich_chipset {
 	CHIPSET_ICH_UNKNOWN,
 	CHIPSET_ICH7 = 7,
@@ -539,6 +538,7 @@ enum ich_chipset {
 	CHIPSET_7_SERIES_PANTHER_POINT
 };
 
+#if CONFIG_INTERNAL == 1
 extern uint32_t ichspi_bbar;
 int ich_init_spi(struct pci_dev *dev, uint32_t base, void *rcrb,
 		 enum ich_chipset ich_generation);

util/ich_descriptors_tool/Makefile

+CC ?= gcc
+
+PROGRAM=ich_descriptors_tool
+EXTRAINCDIRS = ../../ .
+DEPPATH = .dep
+OBJATH = .obj
+SHAREDSRC = ich_descriptors.c
+SHAREDSRCDIR = ../..
+
+SRC = $(wildcard *.c)
+
+CFLAGS += -Wall
+CFLAGS += -MMD -MP -MF $(DEPPATH)/$(@F).d
+# enables functions that populate the descriptor structs from plain binary dumps
+CFLAGS += -D ICH_DESCRIPTORS_FROM_DUMP
+CFLAGS += $(patsubst %,-I%,$(EXTRAINCDIRS))
+
+OBJ = $(OBJATH)/$(SRC:%.c=%.o)
+
+SHAREDOBJ = $(OBJATH)/$(notdir $(SHAREDSRC:%.c=%.o))
+
+all:$(PROGRAM)
+
+$(OBJ): $(OBJATH)/%.o : %.c
+	$(CC) $(CFLAGS) -o $@ -c $<
+
+# this enables us to share source files without simultaneously sharing .o files
+# with flashrom, which would lead to unexpected results (w/o running make clean)
+$(SHAREDOBJ): $(OBJATH)/%.o : $(SHAREDSRCDIR)/%.c
+	$(CC) $(CFLAGS) -o $@ -c $<
+
+$(PROGRAM): $(OBJ) $(SHAREDOBJ)
+	$(CC) -o $(PROGRAM) $(OBJ) $(SHAREDOBJ)
+
+clean:
+	rm -f $(PROGRAM)
+	rm -rf $(DEPPATH) $(OBJATH)
+
+# Include the dependency files.
+-include $(shell mkdir -p $(DEPPATH) $(OBJATH) 2>/dev/null) $(wildcard $(DEPPATH)/*)
+
+.PHONY: all clean

util/ich_descriptors_tool/TODO

+- reverse the path: assemble a descriptormode image from various
+  blobs (BIOS, GbE, ME, OEM) and a description (xml? custom config?
+  sane defaults and cmd-line switches?)
+- dump 256 OEM bytes
+- deal with the various possible locations of mac address(es?)
+	/* mazzoo said: from what I've seen, the MAC address is the 1st or
+	 * 2nd 6 bytes in the GbE region. It seems the PXE-OpROM and/or the
+	 * intel EEUPDATE-tool copies the MAC address to the 2nd part.
+	 */
+- add descriptions for the missing chipsets

util/ich_descriptors_tool/ich_descriptors_tool.c

+/*
+ * This file is part of the flashrom project.
+ *
+ * Copyright (C) 2010  Matthias Wenzel <bios at mazzoo dot de>
+ * Copyright (C) 2011 Stefan Tauner
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+ */
+
+/*
+ * dump information and binaries from BIOS images that are in descriptor mode
+ */
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <string.h>
+#include <errno.h>
+#include "ich_descriptors.h"
+
+static void dump_file(const char *basename, const uint32_t *dump, unsigned int len, struct ich_desc_region *reg, unsigned int i)
+{
+	int ret;
+	char *fn;
+	const char *reg_name;
+	uint32_t file_len;
+	const char *const region_names[5] = {
+		"Descriptor", "BIOS", "ME", "GbE", "Platform"
+	};
+	uint32_t base = ICH_FREG_BASE(reg->FLREGs[i]);
+	uint32_t limit = ICH_FREG_LIMIT(reg->FLREGs[i]);
+
+	reg_name = region_names[i];
+	if (base > limit) {
+		printf("The %s region is unused and thus not dumped.\n",
+		       reg_name);
+		return;
+	}
+
+	limit = limit | 0x0fff;
+	file_len = limit + 1 - base;
+	if (base + file_len > len) {
+		printf("The %s region is spanning 0x%08x-0x%08x, but it is "
+		       "not (fully) included in the image (0-0x%08x), thus not "
+		       "dumped.\n", reg_name, base, limit, len - 1);
+		return;
+	}
+
+	fn = malloc(strlen(basename) + strlen(reg_name) + strlen(".bin") + 2);
+	if (!fn) {
+		fprintf(stderr, "Out of memory!\n");
+		exit(1);
+	}
+	snprintf(fn, strlen(basename) + strlen(reg_name) + strlen(".bin") + 2,
+		 "%s.%s.bin", basename, reg_name);
+	printf("Dumping %u bytes of the %s region from 0x%08x-0x%08x to %s... ",
+	       file_len, region_names[i], base, limit, fn);
+	int fh = open(fn, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+	free(fn);
+	if (fh < 0) {
+		fprintf(stderr,
+			"ERROR: couldn't open(%s): %s\n", fn, strerror(errno));
+		exit(1);
+	}
+
+	ret = write(fh, &dump[base >> 2], file_len);
+	if (ret != file_len) {
+		fprintf(stderr, "FAILED.\n");
+		exit(1);
+	}
+
+	printf("done.\n");
+	close(fh);
+}
+
+void dump_files(const char *n, const uint32_t *buf, unsigned int len, struct ich_desc_region *reg)
+{
+	unsigned int i;
+	printf("=== Dumping region files ===\n");
+	for (i = 0; i < 5; i++)
+		dump_file(n, buf, len, reg, i);
+	printf("\n");
+}
+
+static void usage(char *argv[], char *error)
+{
+	if (error != NULL) {
+		fprintf(stderr, "%s\n", error);
+	}
+	printf("usage: '%s -f <image file name> [-c <chipset name>] [-d]'\n\n"
+"where <image file name> points to an image of the contents of the SPI flash.\n"
+"In case the image is really in descriptor mode %s\n"
+"will pretty print some of the contained information.\n"
+"To also print the data stored in the descriptor strap you have to indicate\n"
+"the chipset series with the '-c' parameter and one of the possible arguments:\n"
+"\t- \"ich8\",\n"
+"\t- \"ich9\",\n"
+"\t- \"ich10\",\n"
+"\t- \"5\" or \"ibex\" for Intel's 5 series chipsets,\n"
+"\t- \"6\" or \"cougar\" for Intel's 6 series chipsets,\n"
+"\t- \"7\" or \"panther\" for Intel's 7 series chipsets.\n"
+"If '-d' is specified some regions such as the BIOS image as seen by the CPU or\n"
+"the GbE blob that is required to initialize the GbE are also dumped to files.\n",
+	argv[0], argv[0]);
+	exit(1);
+}
+
+int main(int argc, char *argv[])
+{
+	int fd;			/* file descriptor to flash file */
+	int len;		/* file/buffer size in bytes */
+	uint32_t *buf;		/* mmap'd file */
+	uint8_t *pMAC;
+	int opt, ret;
+
+	int dump = 0;
+	const char *fn = NULL;
+	const char *csn = NULL;
+	enum ich_chipset cs = CHIPSET_ICH_UNKNOWN;
+	struct ich_descriptors desc = {{ 0 }};
+
+	while ((opt = getopt(argc, argv, "df:c:")) != -1) {
+		switch (opt) {
+		case 'd':
+			dump = 1;
+			break;
+		case 'f':
+			fn = optarg;
+			break;
+		case 'c':
+			csn = optarg;
+			break;
+		default: /* '?' */
+			usage(argv, NULL);
+		}
+	}
+	if (fn == NULL)
+		usage(argv,
+		      "Need a file name of a descriptor image to read from.");
+
+	fd = open(fn, O_RDONLY);
+	if (fd < 0)
+		usage(argv, "No such file");
+	len = lseek(fd, 0, SEEK_END);
+	if (len < 0)
+		usage(argv, "Seeking to the end of the file failed");
+
+	buf = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0);
+	if (buf == (void *) -1) {
+		/* fallback for stupid OSes like cygwin */
+		int ret;
+		buf = malloc(len);
+		if (!buf)
+			usage(argv, "Could not allocate memory");
+		lseek(fd, 0, SEEK_SET);
+		ret = read(fd, buf, len);
+		if (ret != len)
+			usage(argv, "Seeking to the end of the file failed");
+	}
+	printf("The flash image has a size of %d [0x%x] bytes.\n", len, len);
+	close(fd);
+
+	if (csn != NULL) {
+		if (strcmp(csn, "ich8") == 0)
+			cs = CHIPSET_ICH8;
+		else if (strcmp(csn, "ich9") == 0)
+			cs = CHIPSET_ICH9;
+		else if (strcmp(csn, "ich10") == 0)
+			cs = CHIPSET_ICH10;
+		else if ((strcmp(csn, "5") == 0) ||
+			 (strcmp(csn, "ibex") == 0))
+			cs = CHIPSET_5_SERIES_IBEX_PEAK;
+		else if ((strcmp(csn, "6") == 0) ||
+			 (strcmp(csn, "cougar") == 0))
+			cs = CHIPSET_6_SERIES_COUGAR_POINT;
+		else if ((strcmp(csn, "7") == 0) ||
+			 (strcmp(csn, "panther") == 0))
+			cs = CHIPSET_7_SERIES_PANTHER_POINT;
+	}
+
+	ret = read_ich_descriptors_from_dump(buf, len, &desc);
+	switch (ret) {
+	case ICH_RET_OK:
+		break;
+	case ICH_RET_ERR:
+		printf("Image not in descriptor mode.\n");
+		exit(1);
+	case ICH_RET_OOB:
+		printf("Tried to access a location out of bounds of the image. "
+		       "- Corrupt image?\n");
+		exit(1);
+	default:
+		printf("Unhandled return value at %s:%u, please report this.\n",
+		       __FILE__, __LINE__);
+		exit(1);
+	}
+
+	prettyprint_ich_descriptors(cs, &desc);
+
+	pMAC = (uint8_t *) &buf[ICH_FREG_BASE(desc.region.reg3_base) >> 2];
+	if (len >= ICH_FREG_BASE(desc.region.reg3_base) + 5 && pMAC[0] != 0xff)
+		printf("The MAC address might be at offset 0x%x: "
+		       "%02x:%02x:%02x:%02x:%02x:%02x\n",
+		       ICH_FREG_BASE(desc.region.reg3_base),
+		       pMAC[0], pMAC[1], pMAC[2], pMAC[3], pMAC[4], pMAC[5]);
+
+	if (dump == 1)
+		dump_files(fn, buf, len, &desc.region);
+
+	return 0;
+}