From 05e37bb5fb3a74e47db5d7523062fcb9cbbcfebf Mon Sep 17 00:00:00 2001 From: "Frinzell, Aaron" Date: Tue, 10 May 2022 13:39:04 -0500 Subject: [PATCH] Add Add usage documentation to memconfig.py Signed-off-by: Frinzell, Aaron --- chipsec/modules/common/memconfig.py | 96 ++++++++++++++++------------- 1 file changed, 53 insertions(+), 43 deletions(-) diff --git a/chipsec/modules/common/memconfig.py b/chipsec/modules/common/memconfig.py index 19a2983b..cbbca8f7 100644 --- a/chipsec/modules/common/memconfig.py +++ b/chipsec/modules/common/memconfig.py @@ -1,27 +1,36 @@ -#CHIPSEC: Platform Security Assessment Framework -#Copyright (c) 2010-2020, Intel Corporation +# CHIPSEC: Platform Security Assessment Framework +# Copyright (c) 2010-2020, Intel Corporation # -#This program is free software; you can redistribute it and/or -#modify it under the terms of the GNU General Public License -#as published by the Free Software Foundation; Version 2. +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; Version 2. # -#This program is distributed in the hope that it will be useful, -#but WITHOUT ANY WARRANTY; without even the implied warranty of -#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -#GNU General Public License for more details. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. # -#You should have received a copy of the GNU General Public License -#along with this program; if not, write to the Free Software -#Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # -#Contact information: -#chipsec@intel.com +# Contact information: +# chipsec@intel.com # """ This module verifies memory map secure configuration, -i.e. that memory map registers are correctly configured and locked down. +that memory map registers are correctly configured and locked down. + +Usage: + ``chipsec_main -m common.memconfig`` + +Example: + >>> chipsec_main.py -m common.memconfig + +.. note:: + - This module will only run on Core (client) platforms. """ from chipsec.module_common import BaseModule, ModuleResult, MTAG_HWCONFIG @@ -32,18 +41,18 @@ TAGS = [MTAG_HWCONFIG] memmap_registers = { - "PCI0.0.0_GGC": 'GGCLOCK', - "PCI0.0.0_PAVPC": 'PAVPLCK', - "PCI0.0.0_DPR": 'LOCK', - "PCI0.0.0_MESEG_MASK": 'MELCK', - "PCI0.0.0_REMAPBASE": 'LOCK', - "PCI0.0.0_REMAPLIMIT": 'LOCK', - "PCI0.0.0_TOM": 'LOCK', - "PCI0.0.0_TOUUD": 'LOCK', - "PCI0.0.0_BDSM": 'LOCK', - "PCI0.0.0_BGSM": 'LOCK', - "PCI0.0.0_TSEGMB": 'LOCK', - "PCI0.0.0_TOLUD": 'LOCK' + "PCI0.0.0_GGC" : 'GGCLOCK', + "PCI0.0.0_PAVPC" : 'PAVPLCK', + "PCI0.0.0_DPR" : 'LOCK', + "PCI0.0.0_MESEG_MASK" : 'MELCK', + "PCI0.0.0_REMAPBASE" : 'LOCK', + "PCI0.0.0_REMAPLIMIT" : 'LOCK', + "PCI0.0.0_TOM" : 'LOCK', + "PCI0.0.0_TOUUD" : 'LOCK', + "PCI0.0.0_BDSM" : 'LOCK', + "PCI0.0.0_BGSM" : 'LOCK', + "PCI0.0.0_TSEGMB" : 'LOCK', + "PCI0.0.0_TOLUD" : 'LOCK' } memmap_registers_dev0bars = [ @@ -61,16 +70,19 @@ class memconfig(BaseModule): def is_supported(self): if self.cs.is_core(): - return True + if self.cs.is_register_defined('MSR_BIOS_DONE'): + return True + self.logger.log_important('MSR_BIOS_DONE register is not defined for platform. Skipping module.') + else: + self.logger.log_important("Not a 'Core' (Desktop) platform. Skipping test.") self.res = ModuleResult.NOTAPPLICABLE return False def check_memmap_locks(self): - self.logger.start_test( "Host Bridge Memory Map Locks" ) # Determine if IA_UNTRUSTED can be used to lock the system. ia_untrusted = None - if self.cs.is_register_defined('MSR_BIOS_DONE') and self.cs.register_has_field('MSR_BIOS_DONE', 'IA_UNTRUSTED'): + if self.cs.register_has_field('MSR_BIOS_DONE', 'IA_UNTRUSTED'): ia_untrusted = self.cs.read_register_field('MSR_BIOS_DONE', 'IA_UNTRUSTED') regs = sorted(memmap_registers.keys()) @@ -83,16 +95,16 @@ class memconfig(BaseModule): self.logger.log('[*] Checking register lock state:') for r in regs: if not self.cs.is_register_defined(r) or not self.cs.register_has_field(r, memmap_registers[r]): - self.logger.log_unknown('Skipping Validation: Register {} or field {} was not defined for this platform.'.format(r, memmap_registers[r])) + self.logger.log_important('Skipping Validation: Register {} or field {} was not defined for this platform.'.format(r, memmap_registers[r])) continue - d = self.cs.get_register_def( r ) - v = self.cs.read_register( r ) - locked = self.cs.get_register_field( r, v, memmap_registers[r] ) + d = self.cs.get_register_def(r) + v = self.cs.read_register(r) + locked = self.cs.get_register_field(r, v, memmap_registers[r]) if locked == 1: - self.logger.log_good( "{:20} = 0x{:16X} - LOCKED - {}".format(r, v, d['desc']) ) + self.logger.log_good("{:20} = 0x{:16X} - LOCKED - {}".format(r, v, d['desc'])) else: all_locked = False - self.logger.log_bad( "{:20} = 0x{:16X} - UNLOCKED - {}".format(r, v, d['desc']) ) + self.logger.log_bad("{:20} = 0x{:16X} - UNLOCKED - {}".format(r, v, d['desc'])) if ia_untrusted is not None: self.logger.log('[*]') @@ -106,17 +118,15 @@ class memconfig(BaseModule): self.logger.log('[*]') if all_locked: res = ModuleResult.PASSED - self.logger.log_passed_check( "All memory map registers seem to be locked down" ) + self.logger.log_passed("All memory map registers seem to be locked down") else: res = ModuleResult.FAILED - self.logger.log_failed_check( "Not all memory map registers are locked down" ) + self.logger.log_failed("Not all memory map registers are locked down") return res - # -------------------------------------------------------------------------- - # run( module_argv ) - # Required function: run here all tests from this module - # -------------------------------------------------------------------------- - def run( self, module_argv ): + def run(self, module_argv): + self.logger.start_test("Host Bridge Memory Map Locks") + self.res = self.check_memmap_locks() return self.res