Re: chipsec integrity check

--===============6152440309817422447==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

The whitelisting looks very helpful. My original plan was to dump the compl=
ete firmware image for integrity checking but I was unable to get a good re=
ad due to some read locked areas even an external programmer couldn't read.=
 So this makes for a good alternative.

Retesting after a reboot is also a good idea. I will try that and compare r=
esults. I didn't realize so much of the firmware was dynamic. I thought tak=
ing a single known good image would be enough.

The ACPI information also looks quite useful. I have played with fwts some =
but it is very complicated. Since the ACPI tables change frequently perhaps=
 I should drop them from the test script.

To answer some of your questions, the test results were generated with vers=
ion 1.3.0. I have built chipsec on a usb drive running centos 7.   Because =
of this, yes, I boot from different media between tests, hdd and usb.

The only changes between tests was normal use, ie reboots, os updates, soft=
ware use. No suspect software has been installed, though finding out the py=
thon pypi repository had been compromised did give me a few worries. The re=
ason for the test was a bios info screen popped up on boot which I found un=
usual because it normally only does that following a firmware update and I =
had not done one.

A few things stand out. You mention MMIO and IOMMU. There are certainly a l=
ot of changes there including some flags that are switched between 0 and 1 =
so it appears the configuration has changed. I leave the BIOS in a static "=
secure" configuration. It was in this configuration for both runs, though I=
 do have to enter the bios to enable usb boot to run chipsec, then after th=
e run I disable it again. It seems that shouldn't matter but I can't be cer=
tain.  You mention some devices were reinitialized. Is this expected behavi=
or? No firmware updates have taken place.

 Also I note pci dump has changed. There have been no hardware changes othe=
r than usb devices plugged and unplugged.

You mention the cmos changes are related to real time clock but what about =
ec dump changes?

Some of the efi variables stand out as well.
TrEEPhysicalPresence
SMBIOSELOG000
System
SctCsmMemoryMapVariable

Thanks greatly for your help and references. To a non specialist the comple=
xity can seem overwhelming.

--===============6152440309817422447==
Content-Type: text/html
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"

PGRpdj5UaGUgd2hpdGVsaXN0aW5nIGxvb2tzIHZlcnkgaGVscGZ1bC4gTXkgb3JpZ2luYWwgcGxh
biB3YXMgdG8gZHVtcCB0aGUgY29tcGxldGUgZmlybXdhcmUgaW1hZ2UgZm9yIGludGVncml0eSBj
aGVja2luZyBidXQgSSB3YXMgdW5hYmxlIHRvIGdldCBhIGdvb2QgcmVhZCBkdWUgdG8gc29tZSBy
ZWFkIGxvY2tlZCBhcmVhcyBldmVuIGFuIGV4dGVybmFsIHByb2dyYW1tZXIgY291bGRuJ3QgcmVh
ZC4gU28gdGhpcyBtYWtlcyBmb3IgYSBnb29kIGFsdGVybmF0aXZlLjxicj48L2Rpdj48ZGl2Pjxi
cj48L2Rpdj48ZGl2PlJldGVzdGluZyBhZnRlciBhIHJlYm9vdCBpcyBhbHNvIGEgZ29vZCBpZGVh
LiBJIHdpbGwgdHJ5IHRoYXQgYW5kIGNvbXBhcmUgcmVzdWx0cy4gSSBkaWRuJ3QgcmVhbGl6ZSBz
byBtdWNoIG9mIHRoZSBmaXJtd2FyZSB3YXMgZHluYW1pYy4gSSB0aG91Z2h0IHRha2luZyBhIHNp
bmdsZSBrbm93biBnb29kIGltYWdlIHdvdWxkIGJlIGVub3VnaC48YnI+PC9kaXY+PGRpdj48YnI+
PC9kaXY+PGRpdj5UaGUgQUNQSSBpbmZvcm1hdGlvbiBhbHNvIGxvb2tzIHF1aXRlIHVzZWZ1bC4g
SSBoYXZlIHBsYXllZCB3aXRoIGZ3dHMgc29tZSBidXQgaXQgaXMgdmVyeSBjb21wbGljYXRlZC4g
U2luY2UgdGhlIEFDUEkgdGFibGVzIGNoYW5nZSBmcmVxdWVudGx5IHBlcmhhcHMgSSBzaG91bGQg
ZHJvcCB0aGVtIGZyb20gdGhlIHRlc3Qgc2NyaXB0Ljxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48
ZGl2PlRvIGFuc3dlciBzb21lIG9mIHlvdXIgcXVlc3Rpb25zLCB0aGUgdGVzdCByZXN1bHRzIHdl
cmUgZ2VuZXJhdGVkIHdpdGggdmVyc2lvbiAxLjMuMC4gSSBoYXZlIGJ1aWx0IGNoaXBzZWMgb24g
YSB1c2IgZHJpdmUgcnVubmluZyBjZW50b3MgNy4mbmJzcDsgJm5ic3A7QmVjYXVzZSBvZiB0aGlz
LCB5ZXMsIEkgYm9vdCBmcm9tIGRpZmZlcmVudCBtZWRpYSBiZXR3ZWVuIHRlc3RzLCBoZGQgYW5k
IHVzYi48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5UaGUgb25seSBjaGFuZ2VzIGJldHdl
ZW4gdGVzdHMgd2FzIG5vcm1hbCB1c2UsIGllIHJlYm9vdHMsIG9zIHVwZGF0ZXMsIHNvZnR3YXJl
IHVzZS4gTm8gc3VzcGVjdCBzb2Z0d2FyZSBoYXMgYmVlbiBpbnN0YWxsZWQsIHRob3VnaCBmaW5k
aW5nIG91dCB0aGUgcHl0aG9uIHB5cGkgcmVwb3NpdG9yeSBoYWQgYmVlbiBjb21wcm9taXNlZCBk
aWQgZ2l2ZSBtZSBhIGZldyB3b3JyaWVzLiBUaGUgcmVhc29uIGZvciB0aGUgdGVzdCB3YXMgYSBi
aW9zIGluZm8gc2NyZWVuIHBvcHBlZCB1cCBvbiBib290IHdoaWNoIEkgZm91bmQgdW51c3VhbCBi
ZWNhdXNlIGl0IG5vcm1hbGx5IG9ubHkgZG9lcyB0aGF0IGZvbGxvd2luZyBhIGZpcm13YXJlIHVw
ZGF0ZSBhbmQgSSBoYWQgbm90IGRvbmUgb25lLjxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2
PkEgZmV3IHRoaW5ncyBzdGFuZCBvdXQuIFlvdSBtZW50aW9uIE1NSU8gYW5kIElPTU1VLiBUaGVy
ZSBhcmUgY2VydGFpbmx5IGEgbG90IG9mIGNoYW5nZXMgdGhlcmUgaW5jbHVkaW5nIHNvbWUgZmxh
Z3MgdGhhdCBhcmUgc3dpdGNoZWQgYmV0d2VlbiAwIGFuZCAxIHNvIGl0IGFwcGVhcnMgdGhlIGNv
bmZpZ3VyYXRpb24gaGFzIGNoYW5nZWQuIEkgbGVhdmUgdGhlIEJJT1MgaW4gYSBzdGF0aWMgInNl
Y3VyZSIgY29uZmlndXJhdGlvbi4gSXQgd2FzIGluIHRoaXMgY29uZmlndXJhdGlvbiBmb3IgYm90
aCBydW5zLCB0aG91Z2ggSSBkbyBoYXZlIHRvIGVudGVyIHRoZSBiaW9zIHRvIGVuYWJsZSB1c2Ig
Ym9vdCB0byBydW4gY2hpcHNlYywgdGhlbiBhZnRlciB0aGUgcnVuIEkgZGlzYWJsZSBpdCBhZ2Fp
bi4gSXQgc2VlbXMgdGhhdCBzaG91bGRuJ3QgbWF0dGVyIGJ1dCBJIGNhbid0IGJlIGNlcnRhaW4u
Jm5ic3A7IFlvdSBtZW50aW9uIHNvbWUgZGV2aWNlcyB3ZXJlIHJlaW5pdGlhbGl6ZWQuIElzIHRo
aXMgZXhwZWN0ZWQgYmVoYXZpb3I/IE5vIGZpcm13YXJlIHVwZGF0ZXMgaGF2ZSB0YWtlbiBwbGFj
ZS48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PjxzcGFuIGNsYXNzPSJmb250IiBzdHlsZT0iZm9u
dC1mYW1pbHk6Q2FsaWJyaSwgc2Fucy1zZXJpZiI+PHNwYW4gY2xhc3M9InNpemUiIHN0eWxlPSJm
b250LXNpemU6MTFwdCI+Jm5ic3A7QWxzbyBJIG5vdGUgcGNpIGR1bXAgaGFzIGNoYW5nZWQuIFRo
ZXJlIGhhdmUgYmVlbiBubyBoYXJkd2FyZSBjaGFuZ2VzIG90aGVyIHRoYW4gdXNiIGRldmljZXMg
cGx1Z2dlZCBhbmQgdW5wbHVnZ2VkLjwvc3Bhbj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+PGJyPjwv
ZGl2PjxkaXY+PHNwYW4gY2xhc3M9ImZvbnQiIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpLCBz
YW5zLXNlcmlmIj48c3BhbiBjbGFzcz0ic2l6ZSIgc3R5bGU9ImZvbnQtc2l6ZToxMXB0Ij5Zb3Ug
bWVudGlvbiB0aGUgY21vcyBjaGFuZ2VzIGFyZSByZWxhdGVkIHRvIHJlYWwgdGltZSBjbG9jayBi
dXQgd2hhdCBhYm91dCBlYyBkdW1wIGNoYW5nZXM/PC9zcGFuPjwvc3Bhbj48YnI+PC9kaXY+PGRp
dj48YnI+PC9kaXY+PGRpdj48c3BhbiBjbGFzcz0iZm9udCIgc3R5bGU9ImZvbnQtZmFtaWx5OkNh
bGlicmksIHNhbnMtc2VyaWYiPjxzcGFuIGNsYXNzPSJzaXplIiBzdHlsZT0iZm9udC1zaXplOjEx
cHQiPlNvbWUgb2YgdGhlIGVmaSB2YXJpYWJsZXMgc3RhbmQgb3V0IGFzIHdlbGwuPC9zcGFuPjwv
c3Bhbj48YnI+PC9kaXY+PGRpdj48c3BhbiBjbGFzcz0iaGlnaGxpZ2h0IiBzdHlsZT0iYmFja2dy
b3VuZC1jb2xvcjpyZ2IoMjQ4LCAyNDgsIDI0OCkiPjxzcGFuIGNsYXNzPSJjb2xvdXIiIHN0eWxl
PSJjb2xvcjpyZ2IoNTEsIDUxLCA1MSkiPjxzcGFuIGNsYXNzPSJmb250IiBzdHlsZT0iZm9udC1m
YW1pbHk6Q29uc29sYXMsIE1lbmxvLCBNb25hY28sICZxdW90O0x1Y2lkYSBDb25zb2xlJnF1b3Q7
LCAmcXVvdDtMaWJlcmF0aW9uIE1vbm8mcXVvdDssICZxdW90O0RlamFWdSBTYW5zIE1vbm8mcXVv
dDssICZxdW90O0JpdHN0cmVhbSBWZXJhIFNhbnMgTW9ubyZxdW90OywgbW9ub3NwYWNlLCBzZXJp
ZiI+PHNwYW4gY2xhc3M9InNpemUiIHN0eWxlPSJmb250LXNpemU6MTMuMnB4Ij5UckVFUGh5c2lj
YWxQcmVzZW5jZTwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48c3Bh
biBjbGFzcz0iaGlnaGxpZ2h0IiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjpyZ2IoMjQ4LCAyNDgs
IDI0OCkiPjxzcGFuIGNsYXNzPSJjb2xvdXIiIHN0eWxlPSJjb2xvcjpyZ2IoNTEsIDUxLCA1MSki
PjxzcGFuIGNsYXNzPSJmb250IiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXMsIE1lbmxvLCBN
b25hY28sICZxdW90O0x1Y2lkYSBDb25zb2xlJnF1b3Q7LCAmcXVvdDtMaWJlcmF0aW9uIE1vbm8m
cXVvdDssICZxdW90O0RlamFWdSBTYW5zIE1vbm8mcXVvdDssICZxdW90O0JpdHN0cmVhbSBWZXJh
IFNhbnMgTW9ubyZxdW90OywgbW9ub3NwYWNlLCBzZXJpZiI+PHNwYW4gY2xhc3M9InNpemUiIHN0
eWxlPSJmb250LXNpemU6MTMuMnB4Ij5TTUJJT1NFTE9HMDAwPC9zcGFuPjwvc3Bhbj48L3NwYW4+
PC9zcGFuPjxicj48L2Rpdj48ZGl2PjxzcGFuIGNsYXNzPSJoaWdobGlnaHQiIHN0eWxlPSJiYWNr
Z3JvdW5kLWNvbG9yOnJnYigyNDgsIDI0OCwgMjQ4KSI+PHNwYW4gY2xhc3M9ImNvbG91ciIgc3R5
bGU9ImNvbG9yOnJnYig1MSwgNTEsIDUxKSI+PHNwYW4gY2xhc3M9ImZvbnQiIHN0eWxlPSJmb250
LWZhbWlseTpDb25zb2xhcywgTWVubG8sIE1vbmFjbywgJnF1b3Q7THVjaWRhIENvbnNvbGUmcXVv
dDssICZxdW90O0xpYmVyYXRpb24gTW9ubyZxdW90OywgJnF1b3Q7RGVqYVZ1IFNhbnMgTW9ubyZx
dW90OywgJnF1b3Q7Qml0c3RyZWFtIFZlcmEgU2FucyBNb25vJnF1b3Q7LCBtb25vc3BhY2UsIHNl
cmlmIj48c3BhbiBjbGFzcz0ic2l6ZSIgc3R5bGU9ImZvbnQtc2l6ZToxMy4ycHgiPlN5c3RlbTwv
c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48YnI+PC9kaXY+PGRpdj48c3BhbiBjbGFzcz0iaGln
aGxpZ2h0IiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjpyZ2IoMjQ4LCAyNDgsIDI0OCkiPjxzcGFu
IGNsYXNzPSJjb2xvdXIiIHN0eWxlPSJjb2xvcjpyZ2IoNTEsIDUxLCA1MSkiPjxzcGFuIGNsYXNz
PSJmb250IiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXMsIE1lbmxvLCBNb25hY28sICZxdW90
O0x1Y2lkYSBDb25zb2xlJnF1b3Q7LCAmcXVvdDtMaWJlcmF0aW9uIE1vbm8mcXVvdDssICZxdW90
O0RlamFWdSBTYW5zIE1vbm8mcXVvdDssICZxdW90O0JpdHN0cmVhbSBWZXJhIFNhbnMgTW9ubyZx
dW90OywgbW9ub3NwYWNlLCBzZXJpZiI+PHNwYW4gY2xhc3M9InNpemUiIHN0eWxlPSJmb250LXNp
emU6MTMuMnB4Ij5TY3RDc21NZW1vcnlNYXBWYXJpYWJsZTwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv
c3Bhbj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48c3BhbiBj
bGFzcz0iaGlnaGxpZ2h0IiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjpyZ2IoMjQ4LCAyNDgsIDI0
OCkiPjxzcGFuIGNsYXNzPSJjb2xvdXIiIHN0eWxlPSJjb2xvcjpyZ2IoNTEsIDUxLCA1MSkiPjxz
cGFuIGNsYXNzPSJmb250IiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXMsIE1lbmxvLCBNb25h
Y28sICZxdW90O0x1Y2lkYSBDb25zb2xlJnF1b3Q7LCAmcXVvdDtMaWJlcmF0aW9uIE1vbm8mcXVv
dDssICZxdW90O0RlamFWdSBTYW5zIE1vbm8mcXVvdDssICZxdW90O0JpdHN0cmVhbSBWZXJhIFNh
bnMgTW9ubyZxdW90OywgbW9ub3NwYWNlLCBzZXJpZiI+PHNwYW4gY2xhc3M9InNpemUiIHN0eWxl
PSJmb250LXNpemU6MTMuMnB4Ij5UaGFua3MgZ3JlYXRseSBmb3IgeW91ciBoZWxwIGFuZCByZWZl
cmVuY2VzLiBUbyBhIG5vbiBzcGVjaWFsaXN0IHRoZSBjb21wbGV4aXR5IGNhbiBzZWVtIG92ZXJ3
aGVsbWluZy48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PGJyPjwvZGl2PjxkaXY+PGJyPjwv
ZGl2Pg==
--===============6152440309817422447==--