Several sources of information documents the first bit of 0xFED30880 to
be "InSMM.STS":
- Some PCH datasheet from
https://www.intel.fr/content/www/fr/fr/products/docs/processors/core/core-technical-resources.html
document the bit 5 of register BIOS_SPI_BC as:
Enable InSMM.STS (EISS): When this bit is set, the BIOS region is
not writable until the CPU sets the InSMM.STS bit.
If this bit [5] is set, then WPD must be a '1' and
InSMM.STS(0xFED3_0880[0]) must be '1' also in order to write to
BIOS region of SPI Flash.
If this bit [5] is clear, then the InSMM.STS is a do not care.
This bit is locked by LE.
(chipsec already defines this bit in pch_c620.xml, and it is named
SMM_BWP in other pch_...xml files)
- Support for this bit was added in coreboot:
https://review.coreboot.org/c/coreboot/+/51796/14
- Support for this bit was added in the EDK II project:
https://github.com/tianocore/edk2-platforms/commit/17f047154203c73065dcdad8b6a2c59460bf2f53
Enable to easy access this bit by definining an INSMM register.
Try harder to fulfill the physical address constraint for the
IOCTL_ALLOC_PHYSMEM ioctl by trying to allocate memory from the zones
that fit the maximum address best, but fall-back to the normal zone in
case the allocation fails.
If we fail to allocate memory that fulfills the maximum physical address
constraint, make the ioctl() fail as well instead of emitting a warning.
This is safer then making, e.g., the tools.smm.smm_ptr module corrupt
unrelated memory just because the allocation happens to be above 4GB but
the pointer passed to SMM is truncated to 32 bit.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
With the addition of a bounce buffer both functions are nearly
identical. They only differ in the direction of copy.
Merge them into a common helper function that gets the copy direction
passed as an argument.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
If we try to write to an address that's not allowed by USERCOPY, the
copy will fail.
Use a bounce buffer to work around that, just like read_mem() does.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
If we get passed an invalid virtual address, make IOCTL_VA2PA fail
instead of returning a bogus address.
Also simplify the code. No need to use 'PHYSICAL_ADDRESS' here,
'phys_addr_t' is just fine.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
If the helper specific va2p() method fails, we shouldn't try to print
'pa' as it might be 'None'.
Swap the error handling with the 'VA -> PA' debug message to avoid
generating a format exception in this case.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
* Allow duplicate PCI device names to map to the same function.
* Update PCI device bus entries to point to a valid bus based on PCI
enumeration.
Signed-off-by: Erik Bjorge <erik.c.bjorge@intel.com>
Drop the unneded register preserving of RBX, RSI and RDI. It's no longer
needed since commit 5c943b8f38 ("Changes to windows helper and driver
to support return values") refactored the code to just work with the
passed SMI_CTX buffer as scratch space.
Also clobber only the lower 16 bits of RAX with 'smi_code_data', as
documented and assumed by callers.
Last, but not least, drop the misleading comment about clobbering DX as
that doesn't happen any more. Also update all other comments to mirror
the current implementation.
This brings the Windows implementation in line with the Linux one.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
chipsec_km.c is mostly self-contained and thereby has no need to export
symbols.
Make almost all of them 'static' and leave only the (config dependent)
unused ones non-static.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
If we fail to allocate memory for chaining the user requested allocation
to our accounting list, we leak 'va.'
Fix that. Also fix the return code to be -ENOMEM instead of -EFAULT for
failing memory allocations.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
In case my_xlate_dev_mem_ptr() fails for a given physical address, we
should return an error instead of trying to read/write to NULL.
Also fix whitespace issues around this code section.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Commit 397b1b8d8b ("drivers/linux: simplify and fix symbol resolving
for kernels >= 5.10") introduced a method for finding the address of
kallsyms_lookup_name() by scanning kernel code around 'sprint_symbol.'
However, it only looked "backwards" which would be fine, as
kallsyms_lookup_name() gets defined before sprint_symbol() in
kallsyms.c. However, gcc's '-freorder-functions' (which is enabled by
default at -O2 / -Os) may put kallsyms_lookup_name() *after*
sprint_symbol() in the object file, making our search fail to find it.
Account for that and search around sprint_symbol() in both directions.
32kB is more than enough to cover all of kallsyms.o.
Fixes: 397b1b8d8b ("drivers/linux: simplify and fix symbol resolving for kernels >= 5.10")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
grsecurity kernels stub out the kallsyms family of functions when the
feature CONFIG_GRKERNSEC_HIDESYM is enabled. This destroys out attempt
to find the address of 'kallsyms_lookup_name' via sprint_symbol().
Prevent that by making use of the '__INCLUDED_BY_HIDESYM' define
grsecurity provides for this exact purpose.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
The current implementation of __swsmi__ for x86-64 is rather complicated
as it uses more registers than needed. Simplyfy it.
We can use the passed SMI_CTX buffer as scratch space without the need
to use intermediate registers (beside for RDI, for which we use R10 -- a
callee clobbered register).
Bring the implementation more in line with its OS X counterpart and
adapt the comments and code to reflect reality, namely:
- change the C type members to mirror the used (and intended) registers,
- mark the registers as in/out parameters in the comments,
- drop the bogus comment about clobbering DX, as we don't do that and
- fix and tweak the comment about split i/o because of picky firmwares.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
When the kernel module is already loaded, don't unload and try to load
it again.
This is not only useful during development where one might change the
kernel module code often and load it manually but also for setups that
lift the strict access restrictions to /dev/chipsec, e.g. to allow a
non-root group access to its interface.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
During development one might build the driver at its source location.
Add the build artefacts to the git ignore list to make `git status` less
noisy.
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Nathaniel Mitchell