Add SMI enumeration mode to the smm_ptr module

Signed-off-by: Carles Pey <[email protected]>
nccgroup · Apr 20, 2024 · 8077447 · 8077447
1 parent 5558244
commit 8077447
Show file tree

Hide file tree

Showing 6 changed files with 318 additions and 23 deletions.
diff --git a/chipsec/hal/interrupts.py b/chipsec/hal/interrupts.py
@@ -62,6 +62,18 @@ def send_SW_SMI(self, thread_id: int, SMI_code_port_value: int, SMI_data_port_va
         logger().log_hal(f"       RDI = 0x{_rdi:016X}")
         return self.cs.helper.send_sw_smi(thread_id, SMI_code_data, _rax, _rbx, _rcx, _rdx, _rsi, _rdi)
 
+    def send_SW_SMI_timed(self, thread_id: int, SMI_code_port_value: int, SMI_data_port_value: int, _rax: int, _rbx: int, _rcx: int, _rdx: int, _rsi: int, _rdi: int) -> Optional[Tuple[int, int, int, int, int, int, int]]:
+        SMI_code_data = (SMI_data_port_value << 8 | SMI_code_port_value)
+        logger().log_hal(
+            f"[intr] Sending SW SMI: code port 0x{SMI_APMC_PORT:02X} <- 0x{SMI_code_port_value:02X}, data port 0x{SMI_APMC_PORT + 1:02X} <- 0x{SMI_data_port_value:02X} (0x{SMI_code_data:04X})")
+        logger().log_hal(f"       RAX = 0x{_rax:016X} (AX will be overridden with values of SW SMI ports B2/B3)")
+        logger().log_hal(f"       RBX = 0x{_rbx:016X}")
+        logger().log_hal(f"       RCX = 0x{_rcx:016X}")
+        logger().log_hal(f"       RDX = 0x{_rdx:016X} (DX will be overridden with 0x00B2)")
+        logger().log_hal(f"       RSI = 0x{_rsi:016X}")
+        logger().log_hal(f"       RDI = 0x{_rdi:016X}")
+        return self.cs.helper.send_sw_smi_timed(thread_id, SMI_code_data, _rax, _rbx, _rcx, _rdx, _rsi, _rdi)
+
     def send_SMI_APMC(self, SMI_code_port_value: int, SMI_data_port_value: int) -> None:
         logger().log_hal(f"[intr] sending SMI via APMC ports: code 0xB2 <- 0x{SMI_code_port_value:02X}, data 0xB3 <- 0x{SMI_data_port_value:02X}")
         self.cs.io.write_port_byte(SMI_DATA_PORT, SMI_data_port_value)

diff --git a/chipsec/helper/linux/linuxhelper.py b/chipsec/helper/linux/linuxhelper.py
@@ -72,6 +72,7 @@
 IOCTL_VA2PA = 0x14
 IOCTL_MSGBUS_SEND_MESSAGE = 0x15
 IOCTL_FREE_PHYSMEM = 0x16
+IOCTL_SWSMI_TIMED = 0x17
 
 _tools = {}
 
@@ -618,6 +619,13 @@ def send_sw_smi(self, cpu_thread_id: int, SMI_code_data: int, _rax: int, _rbx: i
         ret = struct.unpack(f'7{self._pack}', out_buf)
         return ret
 
+    def send_sw_smi_timed(self, cpu_thread_id: int, SMI_code_data: int, _rax: int, _rbx: int, _rcx: int, _rdx: int, _rsi: int, _rdi: int) -> Optional[Tuple[int, int, int, int, int, int, int]]:
+        self.set_affinity(cpu_thread_id)
+        in_buf = struct.pack(f'8{self._pack}', SMI_code_data, _rax, _rbx, _rcx, _rdx, _rsi, _rdi, 0)
+        out_buf = self.ioctl(IOCTL_SWSMI_TIMED, in_buf)
+        ret = struct.unpack(f'8{self._pack}', out_buf)
+        return ret
+
     #
     # File system
     #