Add SMI enumeration mode to the smm_ptr module #2141
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Carles Pey <carles.pey@nccgroup.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
chipsec/modules/tools/smm/smm_ptr.py
Outdated
| if scan and scan.skip(): | ||
| break | ||
| if scan_mode: | ||
| msg = scan.log_smi_result(self.logger) |
Check notice
Code scanning / CodeQL
Unused local variable Note
| self.hist_smi_num = 0 | ||
| self.outliers_hist = 0 | ||
|
|
||
| def find_address_in_regs(self, gprs): |
Check notice
Code scanning / CodeQL
Explicit returns mixed with implicit (fall through) returns Note
chipsec/modules/tools/smm/smm_ptr.py
Outdated
| self.data = data | ||
|
|
||
| def get_info(self): | ||
| if self.code == None: |
Check notice
Code scanning / CodeQL
Testing equality to None Note
| except BadSMIDetected as msg: | ||
| bad_ptr_cnt = 1 | ||
| self.logger.log_important("Potentially bad SMI detected! Stopped fuzing (see FUZZ_BAIL_ON_1ST_DETECT option)") | ||
|
|
||
| if scan_mode: | ||
| self.logger.log_good(f'<<< Done: found {scan.get_total_outliers()} long-running SMIs') |
Check failure
Code scanning / CodeQL
Potentially uninitialized local variable Error
npmitche
reviewed
Apr 22, 2024
cpey
force-pushed
the
smi-enumeration
branch
3 times, most recently
from
49eebf8
to
081890f
Compare
|
Hi @npmitche, is there any progress on this? |
npmitche
requested changes
May 20, 2024
Signed-off-by: Carles Pey <carles.pey@nccgroup.com>
npmitche
approved these changes
May 21, 2024
Sae86
approved these changes
May 28, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The following pull request extends the
smm_ptrmodule by adding an additionalmode called
scan.The goal of the
scanmode is to identify SMIs that trigger time-consumingcode paths by measuring their execution time. This new mode operates similarly
to the fuzz mode and uses a new syscall that returns the SMI execution time.
With the intention to minimize system crashes, its operation bails out from the
currently scanned SMI code when an SMI taking considerably longer is
encountered or memory changes have been detected.
A time-consuming SMI is referred to as 'outlier' in the implementation, and
determined by the configuration option
OUTLIER_THRESHOLD.When an 'outlier' is identified, a message similar to the one shown below is
added to the output log.
The message informs about the average CPU counts for that SMI code, the number
of SMIs executed for that code (scanning for data and rcx values) until the
first outlier is found or a memory change detected (in
checked), followed byinformation about the outlier.
When no outlier is found, the log message does not include the 'outlier'
information.
At the end of the report, it lists the number of long-running SMIs found,
followed by the remaining smm_ptr results.