Skip to content

Latest commit

 

History

History
160 lines (118 loc) · 5.48 KB

README.md

File metadata and controls

160 lines (118 loc) · 5.48 KB
Raw

culvert - A test and debug tool for BMC AHB bridges

Warning

DO NOT USE THIS TOOL IF YOU HAVE NOT UNDERSTOOD ITS BEHAVIOURS IN THE CONTEXT OF YOUR TARGET MACHINE.

This tool pokes at low-level hardware and firmware interfaces of your machine. Particularly, the act of probing implies uncertainty about the consequences if the target device is not the device we hoped to find.

Use of this tool may lead to instability, crashes or critical failures of the target machine.

Introduction

ASPEED BMCs have several implicit modes of operation:

  1. Development: BMC / host firmware bring-up
  2. IO-Expander: The BMC does not run a dedicated firmware
  3. Provisioned: The BMC runs a dedicated firmware

To provide for 1 and 2, the BMC exposes features on several of its slave interfaces that allow the host to reach into the BMC and perform arbitrary operations in its physical address space.

The significant interfaces hang off of both the PCIe and LPC buses, as either may not be connected to the host CPU in a given platform design.

Mode 3 is also typically used, but for the AST2400 and AST2500s the hardware is configured for modes 1 and 2 at cold boot. Thus the onus is on BMC firmware developers to ensure that all the interfaces are secured if they wish to maintain confidentiality, integrity and availability of the BMC's at-rest data and runtime environments.

Interfaces

  • PCIe VGA P2A: A PCIe MMIO interface providing a arbitrary AHB access via a 64kiB sliding window

    • Write filters can be configured in the SCU to protect the integrity of coarse-grained AHB regions. By default the write filters are not enabled (all AHB regions are writable).

  • iLPC2AHB: A SuperIO logical device providing arbitrary AHB access

    • A write filter that covers the entire AHB is exposed in the LPC controller. By default the write filter is not enabled (AHB is writable).

  • Debug UART: A hardware-provided UART debug shell with arbitrary AHB access

    • Available on one of either UART1 or UART5

  • X-DMA: Arbitrary M-Bus access

  • PCIe BMC device: A collection of fixed PCIe MMIO interfaces providing restricted AHB access via 4kiB windows

  • LPC2AHB: A BMC-controlled mapping of LPC FW cycles onto the AHB

Tool Features

  • Currently supports use of the P2A, iLPC2AHB, LPC2AHB and Debug UART interfaces

  • Probes for the availability of all interfaces over any available interface

    • Can optionally set the exit status based on confidentiality and integrity requirements. Ideal for integration into platform security test suites.

  • In-band BMC console from the host

  • Reflash or dump the firmware of a running BMC from the host

    • The BMC CPU is clock-gated immediately prior to beginning the flash operations, and ungated immediately prior to a SoC reset subsequent to completion of the flash operations.

  • Read and write BMC RAM

  • Also supports the Linux /dev/mem interface for execution on the BMC itself

  • Expose internal JTAG master as OpenOCD-compatible bitbang interface

    • Can access internal BMC/ARM CPU or externally attached JTAG devices (like CPLDs or even host CPUs)

Building

The can be built for multiple architectures. It's known to run on the following:

  • x86_64
  • powerpc64, powerpc64le
  • armv6
  • aarch64

It can be built with:

$ meson setup build && meson compile -C build

or to cross compile:

$ meson setup build-arm --cross-file meson/arm-linux-gnueabi-gcc.ini && meson compile -C build-arm

Dependencies (Debian)

apt install build-essential flex swig bison meson device-tree-compiler libyaml-dev

Execution and Example output

$ ./build/src/culvert -h
culvert: v0.4.0-196-g34001fbe828a
Usage:

        culvert console HOST_UART BMC_UART BAUD USER PASSWORD
        culvert coprocessor <run ADDRESS LENGTH|stop> [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert debug <read ADDRESS|write ADDRESS VALUE> INTERFACE [IP PORT USERNAME PASSWORD]
        culvert devmem <read ADDRESS|write ADDRESS VALUE>
        culvert ilpc <read ADDRESS|write ADDRESS VALUE
        culvert jtag [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert otp <read <conf|strap>|write <conf WORD BIT|strap BIT VALUE>> [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert p2a vga <read ADDRESS|write ADDRESS VALUE>
        culvert probe [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert read <firmware|ram ADDRESS LENGTH> [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert replace ram MATCH REPLACE
        culvert reset TYPE WDT [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert sfc fmc <erase|read|write> ADDRESS LENGTH [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert trace ADDRESS WIDTH MODE [INTERFACE [IP PORT USERNAME PASSWORD]]
        culvert write <firmware|ram ADDRESS LENGTH> [INTERFACE [IP PORT USERNAME PASSWORD]]

# ./culvert probe --require confidentiality
debug:  Permissive
        Debug UART port: UART5
xdma:   Permissive
        BMC: Disabled
        VGA: Enabled
        XDMA on VGA: Enabled
        XDMA is constrained: No
p2a:    Permissive
        BMC: Disabled
        VGA: Enabled
        MMIO on VGA: Enabled
        [0x00000000 - 0x0fffffff]   Firmware: Writable
        [0x10000000 - 0x1fffffff]     SoC IO: Writable
        [0x20000000 - 0x2fffffff]  BMC Flash: Writable
        [0x30000000 - 0x3fffffff] Host Flash: Writable
        [0x40000000 - 0x5fffffff]   Reserved: Writable
        [0x60000000 - 0x7fffffff]   LPC Host: Writable
        [0x80000000 - 0xffffffff]       DRAM: Writable
ilpc:   Disabled
# echo $?
1
#