admin/chipsec-chipsec
1
0
Fork 0
mirror of https://github.com/chipsec/chipsec synced 2026-06-08 13:31:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
c97e8fad7c16f51d1f4dfd85bbc8d851e160efdb
chipsec-chipsec/source/tool/chipsec/modules/remap.py
T
CHIPSEC 0654edca19 Version 1.2.0 
Revision 1.2.0
--------------

This version includes the following new or updated modules:

#. Merged common.secureboot.keys module into common.secureboot.variables
module
#. Updated tools.secureboot.te module to be able to test PE/TE issue on
Linux or UEFI shell
#. Updated tools.smm.smm_ptr module

This version includes the following updates:

#. Added the *controls* abstraction. Modules are encouraged to use
``get_control`` and ``set_control`` when interacting with platform
registers. This permits greater flexibility in case the register that
controls a given feature or configuration changes between platform
generations. The controls are defined in the platform XML file. At this
time, only a small number of controls are defined. We plan to move
existing modules over to this new mechanism.
#. Added XML Schema for the XML configuration files
#. Support for reading, writing, and listing UEFI variables from the
UEFI Shell environment has been added.
#. Added support for decompression while SPI flash parsing via
``decode`` or ``uefi decode`` commands in Linux
#. Added basic ACPI table parsing to HAL (RSDP, RSDT/XSDT, APIC, DMAR)
#. Added UEFI tables searching and parsing to HAL (EFI system table,
runtime services table, boot services table, DXE services table, EFI
configuration table)
#. Added DIMM Serial Presence Detect (SPD) ROM dumping and parsing to
HAL
#. Added ``uefi s3bootscript`` command parsing the S3 boot script to
chipsec_util.py
#. Added virtual-to-physical address translation function to
Linux/EFI/Windows helpers
#. Added support of server platforms (Haswell server and Ivy Town) to
chipset.py

This version has the following known issues:

#. Decompression of images in SPI flash parsing is not available in UEFI
shell.
#. When calling alloc_phys_mem, the argument to set maximum physical
address (max_pa) for allocation is ignored on linux. A message will be
printed in dmesg if the allocation is above the max_pa that is passed
in, but the call will return anyway.
#. UEFI Shell environment does not support ``cpuid`` or
``get_thread_count``. There are functions that simply warn that they are
not supported.
#. Size of PCIEXBAR (MMCFG) is calculated incorrectly
2015-06-09 16:48:26 -07:00

141 lines
6.2 KiB
Python
Raw Blame History

#CHIPSEC: Platform Security Assessment Framework
#Copyright (c) 2010-2015, Intel Corporation
#
#This program is free software; you can redistribute it and/or
#modify it under the terms of the GNU General Public License
#as published by the Free Software Foundation; Version 2.
#
#This program is distributed in the hope that it will be useful,
#but WITHOUT ANY WARRANTY; without even the implied warranty of
#MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
#GNU General Public License for more details.
#
#You should have received a copy of the GNU General Public License
#along with this program; if not, write to the Free Software
#Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#
#Contact information:
#chipsec@intel.com
#
"""
`Preventing & Detecting Xen Hypervisor Subversions <http://www.invisiblethingslab.com/resources/bh08/part2-full.pdf>`_ by Joanna Rutkowska & Rafal Wojtczuk
Check Memory Remapping Configuration
"""
from chipsec.module_common import *
import chipsec.chipset
_MODULE_NAME = 'remap'
TAGS = [MTAG_SMM,MTAG_HWCONFIG]
_REMAP_ADDR_MASK = 0x7FFFF00000
_TOLUD_MASK = 0xFFFFF000
class remap(BaseModule):
def __init__(self):
BaseModule.__init__(self)
def is_supported(self):
if self.cs.get_chipset_id() in chipsec.chipset.CHIPSET_FAMILY_CORE:
return True
return False
def check_remap_config(self):
self.logger.start_test( "Memory Remapping Configuration" )
if not chipsec.chipset.is_register_defined( self.cs, 'PCI0.0.0_REMAPBASE' ) or \
not chipsec.chipset.is_register_defined( self.cs, 'PCI0.0.0_REMAPLIMIT' ) or \
not chipsec.chipset.is_register_defined( self.cs, 'PCI0.0.0_TOUUD' ) or \
not chipsec.chipset.is_register_defined( self.cs, 'PCI0.0.0_TOLUD' ) or \
not chipsec.chipset.is_register_defined( self.cs, 'PCI0.0.0_TSEGMB' ):
self.logger.error( "Couldn't find definition of required registers (REMAP*, TOLUD, TOUUD, TSEGMB)" )
return ModuleResult.ERROR
remapbase = chipsec.chipset.read_register( self.cs, 'PCI0.0.0_REMAPBASE' )
remaplimit = chipsec.chipset.read_register( self.cs, 'PCI0.0.0_REMAPLIMIT' )
touud = chipsec.chipset.read_register( self.cs, 'PCI0.0.0_TOUUD' )
tolud = chipsec.chipset.read_register( self.cs, 'PCI0.0.0_TOLUD' )
tsegmb = chipsec.chipset.read_register( self.cs, 'PCI0.0.0_TSEGMB' )
self.logger.log( "[*] Registers:" )
self.logger.log( "[*] TOUUD : 0x%016X" % touud )
self.logger.log( "[*] REMAPLIMIT: 0x%016X" % remaplimit )
self.logger.log( "[*] REMAPBASE : 0x%016X" % remapbase )
self.logger.log( "[*] TOLUD : 0x%08X" % tolud )
self.logger.log( "[*] TSEGMB : 0x%08X\n" % tsegmb )
remapbase_lock = remapbase & 0x1
remaplimit_lock = remaplimit & 0x1
touud_lock = touud & 0x1
tolud_lock = tolud & 0x1
tsegmb_lock = tsegmb & 0x1
remapbase &= _REMAP_ADDR_MASK
remaplimit &= _REMAP_ADDR_MASK
#remaplimit |= 0xFFFFF
touud &= _REMAP_ADDR_MASK
tolud &= _TOLUD_MASK
tsegmb &= _TOLUD_MASK
self.logger.log( "[*] Memory Map:" )
self.logger.log( "[*] Top Of Upper Memory: 0x%016X" % touud )
self.logger.log( "[*] Remap Limit Address: 0x%016X" % (remaplimit|0xFFFFF) )
self.logger.log( "[*] Remap Base Address : 0x%016X" % remapbase )
self.logger.log( "[*] 4GB : 0x%016X" % self.cs.Cfg.BIT32 )
self.logger.log( "[*] Top Of Low Memory : 0x%016X" % tolud )
self.logger.log( "[*] TSEG (SMRAM) Base : 0x%016X\n" % tsegmb )
remap_ok = True
self.logger.log( "[*] checking memory remap configuration.." )
if remapbase > remaplimit:
self.logger.log( "[*] Memory Remap is disabled" )
else:
self.logger.log( "[*] Memory Remap is enabled" )
remaplimit_addr = (remaplimit|0xFFFFF)
ok = ((remaplimit_addr + 1) == touud)
remap_ok = remap_ok and ok
if ok: self.logger.log_good( " Remap window configuration is correct: REMAPBASE <= REMAPLIMIT < TOUUD" )
else: self.logger.log_bad( " Remap window configuration is not correct" )
ok = (0 == tolud & self.cs.Cfg.ALIGNED_1MB) and \
(0 == touud & self.cs.Cfg.ALIGNED_1MB) and \
(0 == remapbase & self.cs.Cfg.ALIGNED_1MB) and \
(0 == remaplimit & self.cs.Cfg.ALIGNED_1MB)
remap_ok = remap_ok and ok
if ok: self.logger.log_good( " All addresses are 1MB aligned" )
else: self.logger.log_bad( " Not all addresses are 1MB aligned" )
self.logger.log( "[*] checking if memory remap configuration is locked.." )
ok = (0 != touud_lock)
remap_ok = remap_ok and ok
if ok: self.logger.log_good( " TOUUD is locked" )
else: self.logger.log_bad( " TOUUD is not locked" )
ok = (0 != tolud_lock)
remap_ok = remap_ok and ok
if ok: self.logger.log_good( " TOLUD is locked" )
else: self.logger.log_bad( " TOLUD is not locked" )
ok = (0 != remapbase_lock) and (0 != remaplimit_lock)
remap_ok = remap_ok and ok
if ok: self.logger.log_good( " REMAPBASE and REMAPLIMIT are locked" )
else: self.logger.log_bad( " REMAPBASE and REMAPLIMIT are not locked" )
self.logger.log('')
if remap_ok: self.logger.log_passed_check( "Memory Remap is configured correctly and locked" )
else: self.logger.log_failed_check( "Memory Remap is not properly configured/locked. Remaping attack may be possible" )
return remap_ok
# --------------------------------------------------------------------------
# run( module_argv )
# Required function: run here all tests from this module
# --------------------------------------------------------------------------
def run( self, module_argv ):
return self.check_remap_config()
Reference in New Issue View Git Blame Copy Permalink