From 8de16fcac9583dccf9d4ace3a032ef84c969a5a0 Mon Sep 17 00:00:00 2001 From: Aaron Frinzell Date: Fri, 3 Dec 2021 15:45:06 -0600 Subject: [PATCH] Better remap.py logic if not reading REMAP registers properly --- chipsec/modules/common/remap.py | 37 ++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/chipsec/modules/common/remap.py b/chipsec/modules/common/remap.py index 879e1cf7..e091d8fd 100644 --- a/chipsec/modules/common/remap.py +++ b/chipsec/modules/common/remap.py @@ -23,7 +23,7 @@ Check Memory Remapping Configuration Reference: -`Preventing & Detecting Xen Hypervisor Subversions `_ by Joanna Rutkowska & Rafal Wojtczuk + `Preventing & Detecting Xen Hypervisor Subversions `_ by Joanna Rutkowska & Rafal Wojtczuk Usage: ``chipsec_main -m common.remap`` @@ -31,7 +31,15 @@ Usage: Example: >>> chipsec_main.py -m common.remap -.. note:: This module will only run on Core platforms. +Registers used: + - PCI0.0.0_REMAPBASE + - PCI0.0.0_REMAPLIMIT + - PCI0.0.0_TOUUD + - PCI0.0.0_TOLUD + - PCI0.0.0_TSEGMB + +.. note:: + This module will only run on Core platforms. """ @@ -60,7 +68,7 @@ class remap(BaseModule): return False def check_remap_config(self): - + is_warning = False if not self.cs.is_register_defined('PCI0.0.0_REMAPBASE' ) or \ not self.cs.is_register_defined('PCI0.0.0_REMAPLIMIT') or \ not self.cs.is_register_defined('PCI0.0.0_TOUUD' ) or \ @@ -106,11 +114,15 @@ class remap(BaseModule): remap_ok = True - self.logger.log( "[*] checking memory remap configuration.." ) - if remapbase > remaplimit: - self.logger.log( "[*] Memory Remap is disabled" ) + self.logger.log("[*] Checking memory remap configuration..") + + if remapbase == remaplimit: + self.logger.log("[!] Memory Remap status is Unknown") + is_warning = True + elif remapbase > remaplimit: + self.logger.log("[*] Memory Remap is disabled") else: - self.logger.log( "[*] Memory Remap is enabled" ) + self.logger.log("[*] Memory Remap is enabled") remaplimit_addr = (remaplimit|0xFFFFF) ok = ((remaplimit_addr + 1) == touud) remap_ok = remap_ok and ok @@ -125,7 +137,7 @@ class remap(BaseModule): if ok: self.logger.log_good(" All addresses are 1MB aligned") else: self.logger.log_bad(" Not all addresses are 1MB aligned") - self.logger.log( "[*] checking if memory remap configuration is locked.." ) + self.logger.log( "[*] Checking if memory remap configuration is locked.." ) ok = (0 != touud_lock) or (0 != ia_untrusted) remap_ok = remap_ok and ok if ok: self.logger.log_good(" TOUUD is locked") @@ -142,8 +154,13 @@ class remap(BaseModule): else: self.logger.log_bad(" REMAPBASE and REMAPLIMIT are not locked") if remap_ok: - res = ModuleResult.PASSED - self.logger.log_passed("Memory Remap is configured correctly and locked") + if is_warning: + self.logger.log_warning("Most Memory Remap registers are configured correctly and locked") + self.logger.log("[!] Manual verification of REMAP BASE and LIMIT register values may be needed.") + res = ModuleResult.WARNING + else: + res = ModuleResult.PASSED + self.logger.log_passed("Memory Remap is configured correctly and locked") else: res = ModuleResult.FAILED self.logger.log_failed("Memory Remap is not properly configured/locked. Remaping attack may be possible")