1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
#!/usr/bin/env python3
"""Does the PSP validate the LOAD_TA command buffer against its own trusted memory region?
Every test so far fuzzed shared-buffer CONTENT. The LOAD_TA descriptor is a separate
host-controlled input: app address/length and cmd_buf address/length. The security-relevant
question is whether SYS_DRV checks that the host-supplied cmd_buf does not overlap the PSP's
own TMR. If it does not, a host can steer TA output into trusted memory -- a write primitive
against the security boundary.
Test, in increasing order of aggression, each on a fresh load:
1. cmd_buf_len = 0 (does it reject a zero-length window?)
2. cmd_buf_len = 0x100000 (a window far larger than the allocation)
3. cmd_buf inside psp.tmr_paddr (the trusted region itself)
Only statuses are interpreted; no attempt is made to read TMR back (the host cannot).
A wedge is recoverable by ATX cycle.
"""
import glob, struct, sys, time
sys.path.insert(0,'/root/psp/hw')
from tinygrad import Device
import tinygrad.runtime.autogen.am.am as am
from ring_wrap import install
adev=Device["AMD"].iface.dev_impl; psp=adev.psp
submit=install(psp,adev)
def alloc(n):
pa=adev.mm.palloc(n,align=0x1000,zero=True,boot=False); return pa,adev.paddr2mc(pa)
blob=open(glob.glob('/root/psp/contall/ta_42-0-0-6_1c874c3c*')[0],'rb').read()
print('tmr_paddr=%#x tmr_size=%#x'%(psp.tmr_paddr, psp.tmr_size), flush=True)
def try_load(tag, cmd_mc, cmd_len):
ap_,amc=alloc(0x80000)
n=(len(blob)+3)&~3
adev.vram.view(ap_,n)[:]=blob+b'\x00'*(n-len(blob)); adev.gmc.flush_hdp()
c=am.struct_psp_gfx_cmd_resp(cmd_id=am.GFX_CMD_ID_LOAD_TA); t=c.cmd.cmd_load_ta
t.app_phy_addr_lo,t.app_phy_addr_hi=amc&0xFFFFFFFF,amc>>32; t.app_len=len(blob)
t.cmd_buf_phy_addr_lo,t.cmd_buf_phy_addr_hi=cmd_mc&0xFFFFFFFF,cmd_mc>>32
t.cmd_buf_len=cmd_len
t0=time.time()
try:
r=submit(c); st=r.resp.status&0xFFFFFFFF; sid=r.resp.session_id
except Exception as e:
try: st=int(str(e).strip().split()[-1])&0xFFFFFFFF
except Exception: st=-1
sid=None
print(' %-34s status %#-12x %.1fs sid=%s'%(tag,st,time.time()-t0,sid), flush=True)
return st,sid
cp,cmc=alloc(0x8000)
try_load('cmd_buf_len = 0', cmc, 0)
try_load('cmd_buf_len = 0x100000', cmc, 0x100000)
tmr_mc = adev.paddr2mc(psp.tmr_paddr) if hasattr(adev,'paddr2mc') else psp.tmr_paddr
try_load('cmd_buf INSIDE the TMR', tmr_mc + 0x1000, 0x1000)
|
