Change in ...coreboot[master]: util/spdtool: Add tool to extract SPD from BLOBs - coreboot-gerrit

13 Feb 2019

Patrick Rudolph has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/31385
Change subject: util/spdtool: Add tool to extract SPD from BLOBs
......................................................................
util/spdtool: Add tool to extract SPD from BLOBs
Opens a binary file to extract DDR SPDs using known bits.
At the moment only DDR4 SPDs are supported.
Dumps the found SPDs into the current folder, as either
binary or hex encoded file.
Works with python2 and python3.
Change-Id: I26dd73d43b724ea6891bb5b6e96856c42db8577c
Signed-off-by: Patrick Rudolph patrick.rudolph@9elements.com
---
A util/spdtool/description.md
A util/spdtool/spdtool.py
2 files changed, 221 insertions(+), 0 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/85/31385/1

diff --git a/util/spdtool/description.md b/util/spdtool/description.md
new file mode 100644
index 0000000..39d4a5c
--- /dev/null
+++ b/util/spdtool/description.md
@@ -0,0 +1,3 @@
+Dumps SPD ROMs from a given blob to seperate files using known patterns
+and reserved bits. Useful for analysing firmware that holds SPDs on boards
+that have soldered down DRAM. `python`
diff --git a/util/spdtool/spdtool.py b/util/spdtool/spdtool.py
new file mode 100644
index 0000000..c20ee57
--- /dev/null
+++ b/util/spdtool/spdtool.py
@@ -0,0 +1,218 @@
+#!/usr/bin/env python
+
+# spdtool - Tool for partial deblobbing of Intel ME/TXE firmware images
+# Copyright (C) 2019 9elements Agency GmbH patrick.rudolph@9elements.com
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+#
+# Parse a BLOB and search for SPD files.
+# First it is searched for a possible SPD header.
+#
+# For each candidate the function verify_match is invoked to check
+# additional fields (known bits, reserved bits, CRC, ...)
+#
+# Dumps the found SPDs into the current folder.
+#
+# Implemented:
+#  DDR4 SPDs
+#
+
+import argparse
+import crc16
+import struct
+
+class Parser(object):
+    def __init__(self, blob, verbose=False, ignorecrc=False):
+        self.blob = blob
+        self.ignorecrc = ignorecrc
+        self.verbose = verbose
+    def get_matches(self):
+        """Return the first byte to look for"""
+        raise Exception("Function not implemented")
+    def verify_match(self, header, offset):
+        """Return true if it looks like a SPD"""
+        raise Exception("Function not implemented")
+    def get_len(self, header, offset):
+        """Return the length of the SPD"""
+        raise Exception("Function not implemented")
+    def get_part_number(self, offset):
+        """Return the part number in SPD"""
+        return ""
+    def get_manufacturer_id(self, offset):
+        """Return the manufacturer ID in SPD"""
+        return 0xffff
+    def get_mtransfers(self, offset):
+        """Return the number of MT/s"""
+        return 0
+
+    def get_manufacturer(self, offset):
+        """Return manufacturer as string"""
+        id = self.get_manufacturer_id(offset)
+        if id == 0xffff:
+            return "Unknown"
+        ids = {
+            0x2c80: "Crucial/Micron",
+            0x4304: "Ramaxel",
+            0x4f01: "Transcend",
+            0x9801: "Kingston",
+            0x987f: "Hynix",
+            0x9e02: "Corsair",
+            0xb004: "OCZ",
+            0xad80: "Hynix/Hyundai",
+            0xb502: "SuperTalent",
+            0xcd04: "GSkill",
+            0xce80: "Samsung",
+            0xfe02: "Elpida",
+            0xff2c: "Micron",
+        }
+        if id in ids:
+            return ids[id]
+        return "Unknown"
+
+    def blob_as_ord(self, offset):
+        """Helper for python2/python3 compability"""
+        return self.blob[offset] if type(self.blob[offset]) is int else ord(self.blob[offset])
+
+    def search(self, start):
+        """Search for SPD at start. Returns -1 on error or offset
+           if found.
+        """
+        for i in self.get_matches():
+            for offset in range(start, len(self.blob)):
+                if self.blob_as_ord(offset) != i:
+                    continue
+                if not self.verify_match(i, offset):
+                    continue
+                return offset, self.get_len(i, offset)
+        return -1, 0
+
+class SPD4Parser(Parser):
+    def get_matches(self):
+        """Return DDR4 possible header candidates"""
+        ret = []
+        for i in [1, 2, 3, 4]:
+            for j in [1, 2]:
+                ret.append(i + j * 16)
+        return ret
+
+    def verify_match(self, header, offset):
+        """Verify DDR4 specific bit fields."""
+        # offset 0 is a candidate, no need to validate
+        if self.blob_as_ord(offset + 1) == 0xff:
+            return False
+        if self.blob_as_ord(offset + 2) != 0x0c:
+            return False
+        if self.blob_as_ord(offset + 5) & 0xc0 > 0:
+            return False
+        if self.blob_as_ord(offset + 6) & 0xc > 0:
+            return False
+        if self.blob_as_ord(offset + 7) & 0xc0 > 0:
+            return False
+        if self.blob_as_ord(offset + 8) != 0:
+            return False
+        if self.blob_as_ord(offset + 9) & 0xf > 0:
+            return False
+        if self.verbose:
+            print("%x: Looks like DDR4 SPD" % offset)
+
+        crc = crc16.crc16xmodem(self.blob[offset:offset + 0x7d + 1])
+        # Vendors ignore the endianness...
+        crc_spd1 = self.blob_as_ord(offset + 0x7f) | (self.blob_as_ord(offset + 0x7e) << 8)
+        crc_spd2 = self.blob_as_ord(offset + 0x7e) | (self.blob_as_ord(offset + 0x7f) << 8)
+        if crc != crc_spd1 and crc != crc_spd2:
+            if self.verbose:
+                print("%x: CRC16 doesn't match" % offset)
+            if not self.ignorecrc:
+                return False
+
+        return True
+
+    def get_len(self, header, offset):
+        """Return the length of the SPD found."""
+        if (header >> 4) & 7 == 1:
+            return 256
+        if (header >> 4) & 7 == 2:
+            return 512
+        return 0
+
+    def get_part_number(self, offset):
+        """Return part number as string"""
+        if offset + 0x15c > len(self.blob):
+            return ""
+        return self.blob[offset + 0x149:offset + 0x15c + 1].decode('utf-8').rstrip()
+
+    def get_manufacturer_id(self, offset):
+       """Return manufacturer ID"""
+       if offset + 0x141 > len(self.blob):
+           return 0xffff
+       return struct.unpack('H', self.blob[offset + 0x140:offset + 0x141 + 1])[0]
+
+    def get_mtransfers(self, offset):
+       """Return MT/s as specified by MTB and FTB"""
+       if offset + 0x7d > len(self.blob):
+           return 0
+
+       if self.blob_as_ord(offset + 0x11) != 0:
+           return 0
+       mtb = 8.0
+       ftb = 1000.0
+       tckm = struct.unpack('B', self.blob[offset + 0x12:offset + 0x12 + 1])[0]
+       tckf = struct.unpack('b', self.blob[offset + 0x7d:offset + 0x7d + 1])[0]
+       return int(2000 / (tckm / mtb + tckf / ftb))
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description='SPD rom dumper')
+    parser.add_argument('--blob', required=True,
+                        help='The ROM to search SPDs in.')
+    parser.add_argument('--spd4', action='store_true', default=False,
+                        help='Search for DDR4 SPDs.')
+    parser.add_argument('--hex', action='store_true', default=False,
+                        help='Store SPD in hex format otherwise binary.')
+    parser.add_argument('-v', '--verbose', help='increase output verbosity',
+                        action='store_true')
+    parser.add_argument('--ignorecrc', help='Ignore CRC missmatch',
+                        action='store_true', default=False)
+    args = parser.parse_args()
+
+    blob = open(args.blob, "rb").read()
+
+    if args.spd4:
+        p = SPD4Parser(blob, args.verbose, args.ignorecrc)
+    else:
+        raise Exception("Must specify one of the following arguments:\n--spd4")
+
+    offset = 0
+    length = 0
+    cnt = 0
+    while True:
+        offset, length = p.search(offset)
+        if length == 0:
+            break
+        print("Found SPD at 0x%x" % offset)
+        print(" '%s', size %d, manufacturer %s (0x%04x) %d MT/s\n" %
+              (p.get_part_number(offset), length, p.get_manufacturer(offset),
+               p.get_manufacturer_id(offset), p.get_mtransfers(offset)))
+        filename = "spd-%d-%s-%s.bin" % (cnt, p.get_part_number(offset),
+                p.get_manufacturer(offset))
+        filename = filename.replace("/", "_")
+        filename = "".join([c for c in filename if c.isalpha() or c.isdigit() or c=='-' or c=='.' or c=='_']).rstrip()
+        if not args.hex:
+            open(filename, "wb").write(blob[offset:offset + length])
+        else:
+            filename += ".hex"
+            fn = open(filename, "w")
+            j = 0
+            for i in blob[offset:offset + length]:
+                fn.write("%02X%s" % (struct.unpack('B',i)[0], " " if j < 15 else "\n"))
+                j = (j + 1) % 16
+        offset += 1
+        cnt += 1
-- 
To view, visit https://review.coreboot.org/c/coreboot/+/31385
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings

Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I26dd73d43b724ea6891bb5b6e96856c42db8577c
Gerrit-Change-Number: 31385
Gerrit-PatchSet: 1
Gerrit-Owner: Patrick Rudolph patrick.rudolph@9elements.com
Gerrit-MessageType: newchange



    