mirror of
https://github.com/chipsec/chipsec
synced 2026-06-08 13:31:00 +00:00
Mathias Krause
6b974e9e29
Since kernel version 4.12 the GDT as seen by SGDT is only an r/o alias mapping located at a fixed address not backed by a dedicated kernel memory allocation. Later kernels moved it further to the "cpu entry area", yet another alias mapping. All, just to mitigate all too easy kernel address leaking in the name of KASLR. Anyhow, the fact that these virtual addresses have no 'struct page' attached prevents us from using virt_to_phys() to resolve its physical address. A full software page table walk is required instead. Luckily, slow_virt_to_phys() does just that. It was introduced in kernel v3.9 so covers all affected kernels. This fixes github issue #608. While at it, extend the switch block to reject invalid descriptor code arguments to not operate on uninitialized descriptor. Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Chipsec Linux kernel module
===========================
This module was originally built on/adapted from fmem 1.5.0 and LoLA (Low Level Access) (https://code.google.com/archive/p/lola-linux/)
To install CHIPSEC framework with the kernel module, please see "Linux Installation" section of chipsec-manual.pdf
When installed, CHIPSEC framework automatically loads and unloads kernel module.
However, if you want to manually build/install the kernel module, please follow instructions below.
To build:
make
To load kernel module:
sudo insmod ./chipsec.ko
To remove kernel module:
sudo rmmod chipsec
NOTE:
You may need run apt-get install python-dev for the Python.h header (needed for switching cpu affinity).
If you already have this in a non-standard location (i.e. any other than /usr/include/python-2.7), you can manually edit the path in drivers/linux/Makefile
NOTE:
Building against recent Linux kernels generates the warning
WARNING: could not find [...]/chipsec/drivers/linux/amd64/.cpu.o.cmd for [...]/chipsec/drivers/linux/amd64/cpu.o
The cmd files are generated with the cmd_and_fixdep rule found in scripts/Kbuild.include, which are used (among other
places) in rule_cc_o_c and rule_as_o_S defined in scripts/Makefile.build (both files are in the kernel source tree).
Removing the warning could be done by converting cpu.asm to cpu.S (i.e. nasm to as), or by adding a rule_nasm_o_asm
to the Kbuild project. The latter might require a new rule in our Makefile:
NASM ?= `which nasm`
NASMFLAGS = -f $(elf-size)
%.o : %.asm
$(NASM) $(NASMFLAGS) $< -o $@
but for now it's probably best to just ignore the warning (it's harmless). See
https://www.kernel.org/doc/ols/2003/ols2003-pages-185-200.pdf for an introduction to Kbuild
https://www.kernel.org/doc/Documentation/kbuild/modules.txt
for more detail.
-------------
fmem 1.5.0
This module creates /dev/fmem device,
that can be used for dumping physical memory,
without limits of /dev/mem (1MB/1GB, depending on distribution)
Tested on i386 and x64, feel free to test it on
different architectures. (and send report please)
Cloned from linux/drivers/char/mem.c
(so GPL license apply)
Original name of this tool was fdump,
which was conflict with already existing tool,
so name was changed to fmem
Bug reports and patches welcome.
2009,2010 niekt0@hysteria.sk
-----
Usage:
$ make
# ./run.sh
# dd if=/dev/fmem of=... bs=1MB count=...
-----
BUGS: if you do something like # dd if=/dev/fmem of=dump
dd will never stop, even if there is no more physical RAM
on the system. This is more a feature, because Linux kernel
don't have stable API, and detection of mapped areas can be
tricky on older kernels. Because primary usage for fmem is
memory forensic, I think it is safer to specify
amount of RAM by hand.
-----