Skip to content

Commit

Permalink
Fix case of SMM_CODE_CHK_EN field
Browse files Browse the repository at this point in the history
Signed-off-by: Nathaniel Mitchell <[email protected]>
  • Loading branch information
npmitche authored and dscott90 committed Jun 24, 2024
1 parent a0de8c7 commit 016b3b5
Show file tree
Hide file tree
Showing 17 changed files with 23 additions and 23 deletions.
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/apl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -398,7 +398,7 @@ document id 334818/334819
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

<!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/bdw.xml
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ XML configuration for Broadwell based platforms
<registers>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>
</registers>

Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/cfl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -296,7 +296,7 @@ XML configuration file for Coffee Lake
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

</registers>
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/cml.xml
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

<!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/dnv.xml
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ XML configuration file for Denverton
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

</registers>
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/glk.xml
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

<!-- Port I/O Registers -->
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/hsw.xml
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ XML configuration file for Haswell based platforms
<registers>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>
</registers>

Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/icl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ [email protected]
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>
<register name="PRMRR_UNCORE_PHYBASE" undef="Not defined for the platform" />
<register name="PRMRR_UNCORE_MASK" undef="Not defined for the platform" />
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/kbl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -339,7 +339,7 @@ http://www.intel.com/content/www/us/en/processors/core/core-technical-resources.
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

</registers>
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/mtl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -288,7 +288,7 @@ https://www.intel.com/content/www/us/en/products/docs/processors/core/core-techn
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>
<register name="MSR_PPIN_CTL" type="msr" msr="0x4E" desc="Protected Processor Inventory Number Enable Control Register">
<field name="ENABLE" bit="1" size="1" desc="Enabled MSR_PPIN_CTL register" />
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/rkl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ https://cdrdv2.intel.com/v1/dl/getContent/636761
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

<!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/rpl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -309,7 +309,7 @@ https://cdrdv2.intel.com/v1/dl/getContent/743844
<field name="PRMRR_MEMTYPE" bit="0" size="3" desc="PRMRR Memory Type"/>
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR"/>
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR"/>
<field name="LOCK" bit="0" size="1" desc="Lock bit"/>
</register>

Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/skl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -344,7 +344,7 @@ http://www.intel.com/content/www/us/en/processors/core/core-technical-resources.
<!-- MSR_SMM_FEATURE_CONTROL -->
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>

</registers>
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/tglh.xml
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ http://www.intel.com/content/www/us/en/processors/core/core-technical-resources.
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit"/>
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR"/>
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR"/>
</register>
<register name="IA32_APIC_BASE" type="msr" msr="0x1B" desc="Local APIC Base"/>

Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/tglu.xml
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ http://www.intel.com/content/www/us/en/processors/core/core-technical-resources.
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>
<!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -->
<!-- PCIe Configuration registers -->
Expand Down
2 changes: 1 addition & 1 deletion chipsec/cfg/8086/whl.xml
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ XML configuration file for Whiskey Lake
</register>
<register name="MSR_SMM_FEATURE_CONTROL" type="msr" msr="0x4E0" desc="Enhanced SMM Feature Control">
<field name="LOCK" bit="0" size="1" desc="Lock bit" />
<field name="SMM_Code_Chk_En" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
<field name="SMM_CODE_CHK_EN" bit="2" size="1" desc="Prevents SMM from executing code outside the ranges defined by the SMRR" />
</register>
</registers>

Expand Down
14 changes: 7 additions & 7 deletions chipsec/modules/common/smm_code_chk.py
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,12 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

"""
SMM_Code_Chk_En (SMM Call-Out) Protection check
SMM_CODE_CHK_EN (SMM Call-Out) Protection check
SMM_Code_Chk_En is a bit found in the MSR_SMM_FEATURE_CONTROL register.
SMM_CODE_CHK_EN is a bit found in the MSR_SMM_FEATURE_CONTROL register.
Once set to '1', any CPU that attempts to execute SMM code not within the ranges defined by the SMRR will assert an unrecoverable MCE.
As such, enabling and locking this bit is an important step in mitigating SMM call-out vulnerabilities.
This CHIPSEC module simply reads the register and checks that SMM_Code_Chk_En is set and locked.
This CHIPSEC module simply reads the register and checks that SMM_CODE_CHK_EN is set and locked.
Reference:
- Intel 64 and IA-32 Architectures Software Developer Manual (SDM)
Expand All @@ -36,7 +36,7 @@
Registers used:
- MSR_SMM_FEATURE_CONTROL.LOCK
- MSR_SMM_FEATURE_CONTROL.SMM_Code_Chk_En
- MSR_SMM_FEATURE_CONTROL.SMM_CODE_CHK_EN
.. note::
- MSR_SMM_FEATURE_CONTROL may not be defined or readable on all platforms.
Expand Down Expand Up @@ -77,7 +77,7 @@ def is_supported(self) -> bool:
def _check_SMM_Code_Chk_En(self, thread_id: int) -> int:
regval = self.cs.register.read('MSR_SMM_FEATURE_CONTROL', thread_id)
lock = self.cs.register.get_field('MSR_SMM_FEATURE_CONTROL', regval, 'LOCK')
code_chk_en = self.cs.register.get_field('MSR_SMM_FEATURE_CONTROL', regval, 'SMM_Code_Chk_En')
code_chk_en = self.cs.register.get_field('MSR_SMM_FEATURE_CONTROL', regval, 'SMM_CODE_CHK_EN')

self.cs.register.print('MSR_SMM_FEATURE_CONTROL', regval, cpu_thread=thread_id)

Expand All @@ -89,8 +89,8 @@ def _check_SMM_Code_Chk_En(self, thread_id: int) -> int:
self.result.setStatusBit(self.result.status.LOCKS)
else:
# MSR_SMM_MCA_CAP (the register that reports enhanced SMM capabilities) can only be read from SMM.
# Thus, there is no way to tell whether the the CPU doesn't support SMM_Code_Chk_En in the first place,
# or the CPU supports SMM_Code_Chk_En but the BIOS forgot to enable it.
# Thus, there is no way to tell whether the the CPU doesn't support SMM_CODE_CHK_EN in the first place,
# or the CPU supports SMM_CODE_CHK_EN but the BIOS forgot to enable it.
#
# In either case, there is nothing that prevents SMM code from executing instructions outside the ranges defined by the SMRRs,
# so we should at least issue a warning regarding that.
Expand Down

0 comments on commit 016b3b5

Please sign in to comment.