Interrupt testing

Interrupt testing

[phcoder]

[-- Attachment #1: Type: text/plain, Size: 208 bytes --]

Hello. Here is a trivial patch for testing which interrupts are and 
which aren't handled by BIOS. Can be used as a simple but not reliable 
test for boot viruses


-- 

Regards
Vladimir 'phcoder' Serbinenko

[-- Attachment #2: inttest.diff --]
[-- Type: text/x-patch, Size: 4138 bytes --]

Index: conf/i386-pc.rmk
===================================================================
--- conf/i386-pc.rmk	(revision 2021)
+++ conf/i386-pc.rmk	(working copy)
@@ -172,3 +181,3 @@
 	vbe.mod vbetest.mod vbeinfo.mod play.mod serial.mod	\
 	ata.mod vga.mod memdisk.mod pci.mod lspci.mod \
 	aout.mod _bsd.mod bsd.mod pxe.mod pxecmd.mod datetime.mod date.mod \
	datehook.mod lsmmap.mod ata_pthru.mod hdparm.mod \
-	usb.mod uhci.mod ohci.mod usbtest.mod usbms.mod usb_keyboard.mod
+	usb.mod uhci.mod ohci.mod usbtest.mod usbms.mod usb_keyboard.mod \
+	inttest.mod
 
+# For inttest.mod.
+inttest_mod_SOURCES = commands/i386/pc/inttest.c
+inttest_mod_CFLAGS = $(COMMON_CFLAGS) -Werror
+inttest_mod_LDFLAGS = $(COMMON_LDFLAGS)
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 2021)
+++ ChangeLog	(working copy)
@@ -1,3 +1,10 @@
+2009-03-07  Vladimir Serbinenko  <phcoder@gmail.com>
+
+	Interrupt tests
+	
+	* commands/i386/pc/inttest.c: new file
+	* conf/i386-pc.rmk: new module inttest.mod
+
 2009-03-07  Bean  <bean123ch@gmail.com>
 
 	* loader/i386/efi/linux.c (grub_rescue_cmd_initrd): Fix a bug in initrd
Index: commands/i386/pc/inttest.c
===================================================================
--- commands/i386/pc/inttest.c	(revision 0)
+++ commands/i386/pc/inttest.c	(revision 0)
@@ -0,0 +1,85 @@
+/* inttest.c - simple interrupt testing */
+/*
+ *  GRUB  --  GRand Unified Bootloader
+ *  Copyright (C) 2009  Free Software Foundation, Inc.
+ *
+ *  GRUB is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  GRUB is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with GRUB.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <grub/types.h>
+#include <grub/misc.h>
+#include <grub/mm.h>
+#include <grub/err.h>
+#include <grub/dl.h>
+#include <grub/normal.h>
+
+static grub_err_t
+grub_cmd_intreport (struct grub_arg_list *state __attribute__ ((unused)),
+		    int argc __attribute__ ((unused)),
+		    char **args __attribute__ ((unused)))
+{
+  grub_uint32_t *vects = 0;
+  int i;
+  for (i = 0; i < 0x100; i++)
+    if(((vects[i] >> 16) + ((vects[i] & 0xffff) >> 4)) >= 0xc000)
+      grub_printf("int %xh in BIOS %x:%x\n",
+		  i, vects[i]>>16, vects[i]&0xffff);
+    else
+      grub_printf("int %xh not in BIOS %x:%x\n",
+		  i, vects[i]>>16, vects[i]&0xffff);
+  return GRUB_ERR_NONE;
+}
+
+static grub_err_t
+grub_cmd_inttest (struct grub_arg_list *state __attribute__ ((unused)),
+		  int argc __attribute__ ((unused)),
+		  char **args __attribute__ ((unused)))
+{
+  grub_uint32_t *vects = 0;
+  int i;
+  for (i = 0; i <= 0x1c; i++)
+    if(((vects[i] >> 16) + ((vects[i] & 0xffff) >> 4)) < 0xc000)
+      return grub_error (GRUB_ERR_TEST_FAILURE, "interrupt %xh isn't in BIOS",
+			 i);
+  if(((vects[0x4a] >> 16) + ((vects[0x4a] & 0xffff) >> 4)) < 0xc000)
+    return grub_error (GRUB_ERR_TEST_FAILURE, "interrupt 4ah isn't in BIOS",
+			 i);
+  if(((vects[0x70] >> 16) + ((vects[0x70] & 0xffff) >> 4)) < 0xc000)
+    return grub_error (GRUB_ERR_TEST_FAILURE, "interrupt 70h isn't in BIOS",
+			 i);
+
+  return GRUB_ERR_NONE;  
+}
+
+GRUB_MOD_INIT(intreport)
+{
+  (void)mod;			/* To stop warning. */
+  grub_register_command ("intreport", grub_cmd_intreport, 
+			 GRUB_COMMAND_FLAG_BOTH,
+			 "intreport", 
+			 "Report which interrupts are and which aren't in BIOS",
+			 0);
+  grub_register_command ("inttest", grub_cmd_inttest, 
+			 GRUB_COMMAND_FLAG_BOTH,
+			 "inttest", 
+			 "Test that commonly used interrupts are in BIOS",
+			 0);
+
+}
+
+GRUB_MOD_FINI(intreport)
+{
+  grub_unregister_command ("intreport");
+  grub_unregister_command ("inttest");
+}

Re: Interrupt testing

[Robert Millan]

On Sat, Mar 07, 2009 at 04:43:01PM +0100, phcoder wrote:
> Hello. Here is a trivial patch for testing which interrupts are and  
> which aren't handled by BIOS. Can be used as a simple but not reliable  
> test for boot viruses

Would it be feasible to make this more generic?  BIOS works with 16-bit 8086
mode interrupt handlers, others might have setup 32-bit interrupt handlers.

What would you think of:

  - Detect both 16-bit / 8086 interrupts and 32-bit ones.
  - Make it agnostic about what firmware instead of assuming BIOS.
  - Building it in i386.rmk instead.

  ?

-- 
Robert Millan

  The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and
  how) you may access your data; but nobody's threatening your freedom: we
  still allow you to remove your data and not access it at all."

Re: Interrupt testing

[Vladimir 'phcoder' Serbinenko]

On Sun, Mar 8, 2009 at 2:32 PM, Robert Millan<rmh@aybabtu.com> wrote:
> On Sat, Mar 07, 2009 at 04:43:01PM +0100, phcoder wrote:
>> Hello. Here is a trivial patch for testing which interrupts are and
>> which aren't handled by BIOS. Can be used as a simple but not reliable
>> test for boot viruses
>
> Would it be feasible to make this more generic?  BIOS works with 16-bit 8086
> mode interrupt handlers, others might have setup 32-bit interrupt handlers.
>
> What would you think of:
>
>  - Detect both 16-bit / 8086 interrupts and 32-bit ones.
>  - Make it agnostic about what firmware instead of assuming BIOS.
>  - Building it in i386.rmk instead.
>
I don't know if it's possible. Any interrupt handler would also
intercept mmap interrupts so checking against memory map is useless.
The problem is to know which parts of memory are ROM and which ones
are RAM. I think what you propose is possible but I don't know how to
do it. The main idea behind this checker is to check for simple boot
viruses (not advanced ones) and the main target for boot viruses is
BIOS (even if EFI would be excellent for virus writers)
>  ?
>
> --
> Robert Millan
>
>  The DRM opt-in fallacy: "Your data belongs to us. We will decide when (and
>  how) you may access your data; but nobody's threatening your freedom: we
>  still allow you to remove your data and not access it at all."
>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> http://lists.gnu.org/mailman/listinfo/grub-devel
>



-- 
Regards
Vladimir 'phcoder' Serbinenko

Personal git repository: http://repo.or.cz/w/grub2/phcoder.git