You can largely ignore this post. I am including this write up for posterity. Might be useful to someone down the road. I've exhausted my knowledge and capabilities. It was fun messing with chipsec and DMA registers.
I made a much more comprehensive DMA over LPC test using chipsec. The overall goal is to determine whether Z390 (or other) chipsets contain undocumented DMA functionality similar to what was present in older H81 chipsets.
Note: It's likely not possible to change this script into a chipsec-less / chipsec-driver-less script. A driver is likely required with test mode on in windows or be on linux is the only way I see this being possible.
It has some linux tests but mainly windows as that's what I know best. I've yet to test on linux.
~
Main Tests and Checks:
LPC Controller Identification (check_lpc_controller):
Identifies the LPC (Low Pin Count) controller on the system
Verifies if it's a Z390 chipset by checking the vendor/device ID
Traditional DMA Register Testing (test_traditional_dma_regs):
Tests if the traditional 8237A DMA controller registers respond
Tries to read and write to the DMA command register
Checks the DMA status register
H81-style DMA Register Testing (test_h81_dma_registers):
Scans for potential hidden DMA registers in the Z390 chipset
Tests specific register offsets that were present in H81 chipsets
Checks if these registers return meaningful values (not all 0s or 1s)
Tests if the registers are writable
ACPI Table Inspection (inspect_acpi_tables_minimal, analyze_acpi_dump):
Dumps and analyzes ACPI tables for DMA-related entries
Looks for SystemMemory operation regions in DSDT that might map to DMA controllers
Searches for DMA-related keywords in ACPI tables
SMI Handler Inspection (inspect_smi_handlers, inspect_smi_handlers_safe):
Examines System Management Interrupt (SMI) handlers
Checks SMI control registers
Tests if SMI commands affect the potential DMA registers
Looks for SMI ports being configured
Platform-Specific Feature Scanning (scan_platform_specific_features, scan_platform_specific_features_enhanced):
Checks vendor-specific registers that might enable/disable legacy features
Scans PCI configuration space for interesting registers
Checks Super I/O chips which might control legacy DMA
Tests legacy DMA controller I/O ports and page registers
Safer DMA Testing (safer_dma_test, safer_dma_test_two):
Performs non-invasive analysis of potential DMA registers
Analyzes register bit patterns without triggering actual DMA operations
Tests incremental changes to single bits rather than complex patterns
Checks register relationships (if writing to one affects others)
System Monitoring (monitor_dma_during_system_events, poll_dma_registers, monitor_dma_registers_long_term):
Monitors DMA registers during normal system events (disk I/O, network activity, etc.)
Polls DMA registers continuously to detect changes
Sets up long-term monitoring to log DMA register values over time
Register Bit Analysis (analyze_register_bits):
Analyzes register bit patterns to understand their potential meaning
Looks for common bit patterns in DMA controllers (enable bits, busy bits, etc.)
The script contains a few advanced tests that are commented out or modified due to potential system instability:
try_h81_dma_activation: Attempts to activate DMA using H81-style registers
comprehensive_dma_test: Performs actual DMA transfers (marked as causing BSOD)
inspect_smi_handlers_direct: Uses direct memory scanning (causes system freeze)
~
Key Findings:
Traditional DMA Registers
The traditional 8237A DMA registers were tested but don't appear to be responsive.
All reads from traditional DMA ports returned 0xFF, indicating they might be disabled or not implemented.
The test reported "DMA1 Command Register does not respond correctly" when it tried to write and read back.
Hidden H81-style DMA Registers
The script found five potential hidden DMA registers at offsets 0xD0-0xE0 in the LPC controller.
All five registers returned non-zero, non-0xFF values and All registers were reported as writable, which is significant:
0xD0 (Control): 0x00112233
0xD4 (Status): 0x00004567
0xD8 (Transfer Count): 0x0000FFCF
0xDC (Address): 0x00000080
0xE0 (Descriptor): 0x00000309
Register Analysis
The control register (0xD0) bit pattern analysis suggests it has several active bits that align with typical DMA controller functions.
The status register (0xD4) shows patterns consistent with a DMA status register.
Writing test patterns to Address and Transfer Count registers showed they accept writes but with some bit masking, suggesting they're real functional registers.
System Monitoring
No changes were detected in these registers during normal system operations (disk I/O, network, audio, USB).
The polling test over 30 seconds showed the registers maintained constant values.
Long-term monitoring also showed the registers maintained constant values.
Super I/O Chip Findings
The test discovered a Super I/O chip (ID: 0x8688) with multiple logical devices using DMA channels.
This suggests the system does have DMA functionality, but it might be routed through the Super I/O chip.
ACPI and SMI Analysis
The ACPI dumps didn't reveal any SystemMemory regions mapped to DMA functionality.
The SMI (System Management Interrupt) tests didn't show any interactions with the potential DMA registers.
0xDC Section - Address Register and Transfer Count Register:
Initially, the address register at 0xDC contained 0x00000080
When attempting to write 0xAABBCCDD to the register, it read back as 0x0000008D
Similarly, writing 0x00001234 to the transfer count register resulted in a read-back value of 0x00009204
This behavior is consistent with a real hardware register that has:
Reserved/Hardwired Bits: Some bits in the registers appear to be hardwired or reserved for specific purposes, which is why the values written and read back are different.
Activity Bits: The change from 0x80 to 0x8D (specifically the addition of the 0xD bit) suggests that the register might have automatically set some status or control bits in response to being accessed.
Hardware Masking: The test identified that certain bits (0x00008030) were masked, meaning the hardware ignores attempts to change these bits or uses them for control purposes internally.
This behavior strongly indicates that these registers are connected to actual hardware functionality rather than being simple memory locations. Real hardware registers often exhibit these types of behaviors:
Bit Masking: Many hardware controllers mask out certain bits that are reserved for status or future use.
Side Effects: Simply reading or writing to hardware registers can have side effects, such as clearing interrupt flags or triggering state changes.
Auto-Increment: The change from 0x80 to 0x8D might represent an auto-increment function, which is common in DMA controllers where the address automatically advances after operations.
Comparison to Traditional DMA Behavior
This behavior is remarkably similar to how traditional 8237A DMA controllers operate. In classic DMA controllers:
Auto-initialization: After a DMA operation, certain bits in the status registers would be set automatically.
Address Modification: DMA controllers typically modify the current address register during operations, often incrementing or decrementing it based on transfer direction.
Read/Write Effects: Reading from or writing to certain registers can have side effects, such as clearing flip-flops or triggering state transitions.
The fact that the register changed from 0x80 to 0x8D after a write attempt strongly suggests that we're seeing actual DMA controller hardware responding, not just a memory location being used to communicate with firmware.
This supports the theory that the Z390 chipset has undocumented but functional DMA capabilities that could be activated through proper register manipulation, possibly with additional SMI handler involvement for more complex operations or for implementing functionality that was previously hardwired in older chipsets.
Overall Assessment
The script has found strong evidence of hidden, undocumented DMA-like registers in the Z390 chipset that appear to be similar to those in the H81 chipset. These registers:
Exist at the expected offsets (0xD0-0xE0)
Contain non-trivial values
Can be read and partially written to and read back reliably. However minimal or no changes. See 0xDC section.
Have bit patterns consistent with DMA functionality
Show certain limitations (bit masking) that would be expected of real hardware registers
However, these registers don't appear to be actively used during normal system operations, suggesting they might be:
Legacy registers kept for backward compatibility
Registers that need special activation sequences
Registers used only by system firmware/BIOS in specific scenarios
The warning in the conclusion is appropriate: "Found potential hidden H81-style DMA registers in Z390." The script detected what appear to be functional DMA control registers that aren't documented in public Z390 specifications.
The traditional 8237A DMA interface appears to be disabled or not implemented in this system, which aligns with Intel's move away from legacy DMA in modern chipsets, but the discovery of these hidden registers suggests some DMA functionality may still exist through alternative interfaces.
~
Conclusion:
The test results strongly indicate that Z390 chipsets contain undocumented DMA-like registers at the same offsets where H81 chipsets had DMA functionality. The key findings from the test and related research indicate:
Hidden Functional Registers: Intel appears to have maintained hidden DMA-like registers in the Z390 chipset that respond to reading and writing, even though official documentation states "LPC no DMA" for this chipset generation.
DMA Signal Traces: Z390 motherboards still have LDRQ# (DMA request) signal traces routed from the Super I/O chip to the PCH, suggesting hardware-level support exists despite official documentation.
The LPC-DMA Connection: According to the Low Pin Count bus specification, the LPC bus includes an "LDRQ#" signal which is "an output from a device that wants to perform direct memory access, either via the Intel 8237A compatible DMA controller, or the LPC-specific bus master protocol."
Firmware-Assisted DMA Emulation: The theory about SMM (System Management Mode) based emulation is plausible. Cr4sh found that SMI handlers in firmware can provide significant functionality through what's called "SMM callout," where System Management Interrupts allow privileged code execution.
Cr4sh's findings: https://web.archive.org/web/20221225012325/ht … lities.html?m=1
sentinelone SMM Bug hunting: https://www.sentinelone.com/labs/zen-and-the- … ulnerabilities/
Why This Might Exist
There are several possible explanations I see for these hidden registers:
Legacy Software Support: The registers might be maintained for compatibility with legacy software that expects traditional DMA functionality.
Firmware Implementation: Intel may be using System Management Mode (SMM) to implement DMA functionality in firmware rather than hardware, with these registers serving as an interface between the OS and SMM handlers.
Undocumented Features: Intel has been known to include undocumented modes in their chipsets, such as the "Manufacturing Mode" discovered in Intel ME that remains accessible if not properly disabled.
Chipset Reuse: There's speculation that Z390 is largely a rebranded Z370 with some additional features, which might explain why legacy hardware interfaces remain present but undocumented.
Technical Analysis of the Hidden Registers
The test found five specific registers that appear to function like classic DMA controller registers:
0xD0 - Control Register (value: 0x00112233): The bit pattern analysis suggests this controls DMA operations with fields for channel selection, direction, and operation mode.
0xD4 - Status Register (value: 0x00004567): Shows patterns consistent with status bits that might indicate transfer completion or errors.
0xD8 - Transfer Count (value: 0x0000FFCF): This appears to specify how many bytes to transfer, with some bit masking.
0xDC - Address Register (value: 0x00000080): Likely specifies source or destination memory address for DMA operations.
0xE0 - Descriptor Control (value: 0x00000309): Could contain additional configuration bits for advanced operations.
The "Firmware-Assisted PseudoDMA" Theory
The theory about firmware-assisted DMA through SMI handlers is particularly interesting. SMM code can perform privileged operations transparent to the operating system, triggered by writing specific values to port 0xB2 (the APMC port).
This would mean that what appears to be direct hardware DMA might actually be a more complex mechanism:
Software writes to these "DMA registers"
A subsequent trigger (perhaps a specific register write) causes an SMI
The SMI handler in firmware executes in SMM and performs the actual data transfer
This approach would allow Intel to maintain software compatibility with legacy DMA interfaces while leveraging more modern capabilities of the chipset.
This implementation would explain why the registers were detected as functional but didn't show activity during normal system operations - they might only be activated when specific access patterns occur or when the SMI handler is triggered.
~
Where to go from here:
Theoretically you could trigger the SMI handler and poll the DMA registers. I've yet to mess with this.
By using these techniques, you could safely probe the SMI handlers and DMA registers to see if they interact in ways that suggest hidden DMA functionality, all while minimizing risk to system stability.
The most common way to trigger an SMI is by writing a value to port 0xB2 (the APMC port). This is relatively safe as it's a standard method used by firmware.
Implement Safer Tests First: Start with tests that are less likely to cause system instability.
Register Monitoring: After each test, check register values to see if they've changed in ways that suggest activation.
Systematic Testing of SMI Commands: Test different SMI command values systematically (0x00 through 0xFF), starting with common values that are known to be safer.
Use ACPI Methods: Some ACPI methods might trigger SMIs more safely through structured interfaces.
Create a Polling Function: Set up a function to safely read the registers without attempting to modify them.
Monitor for Changes: Poll before and after each SMI trigger to detect changes.
Memory Buffer Preparation: Allocate a safe memory buffer for potential DMA operations.
Set Up a Monitor for Unexpected Changes.
~
If you read this entire post, I appreciate you.
~
Script output:
PS [REDACTED]\chipsec-1.13.11> python chipsec_main.py -m common.lpc_dma_h81_z390_test […]
Show full quote
PS [REDACTED]\chipsec-1.13.11> python chipsec_main.py -m common.lpc_dma_h81_z390_test
################################################################
## ##
## CHIPSEC: Platform Hardware Security Assessment Framework ##
## ##
################################################################
[CHIPSEC] Version : 1.13.11
[CHIPSEC] Arguments: -m common.lpc_dma_h81_z390_test
WARNING: *******************************************************************
WARNING: Chipsec should only be used on test systems!
WARNING: It should not be installed/deployed on production end-user systems.
WARNING: See WARNING.txt
WARNING: *******************************************************************
[CHIPSEC] OS : Windows 10 10.0.19045 AMD64
[CHIPSEC] Python : 3.13.2 (64-bit) - Enabled GIL
[CHIPSEC] Helper : WindowsHelper (\??\[REDACTED]\chipsec-1.13.11\chipsec\helper\windows\windows_amd64\chipsec_hlpr.sys)
[CHIPSEC] Platform: Desktop 8th Generation Core Processor (Coffeelake S 6 Cores)
[CHIPSEC] CPUID: 906EC
[CHIPSEC] VID: 8086
[CHIPSEC] DID: 3EC2
[CHIPSEC] RID: 0A
[CHIPSEC] PCH : Intel Z390 (300 series) PCH
[CHIPSEC] VID: 8086
[CHIPSEC] DID: A305
[CHIPSEC] RID: 10
[+] loaded chipsec.modules.common.lpc_dma_h81_z390_test
[*] running loaded modules ..
[*] Running module: chipsec.modules.common.lpc_dma_h81_z390_test
##################################################
# Z390 Undocumented DMA over LPC Test
# Checks for H81-style hidden DMA in Z390
##################################################
[*] Identifying LPC controller...
[+] Found Intel LPC controller: VID=0x8086, DID=0xA305
[+] Confirmed Z390 chipset
##################################################
TESTING --- test_traditional_dma_regs
##################################################
[*] Testing traditional 8237A DMA registers...
DMA1 Command Register initial value: 0xFF
DMA1 Command Register after write: 0xFF
WARNING: DMA1 Command Register does not respond correctly
DMA1 Status Register: 0xFF
##################################################
TESTING --- test_h81_dma_registers
##################################################
[*] Testing for H81-style DMA registers in Z390...
WARNING: Potential DMA register found: General DMA Control (0xD0) = 0x00112233
WARNING: Register at 0xD0 is WRITABLE - potential DMA control register!
WARNING: Potential DMA register found: General DMA Status (0xD4) = 0x00004567
WARNING: Register at 0xD4 is WRITABLE - potential DMA control register!
WARNING: Potential DMA register found: General DMA Transfer Count (0xD8) = 0x0000FFCF
WARNING: Register at 0xD8 is WRITABLE - potential DMA control register!
WARNING: Potential DMA register found: General DMA Address (0xDC) = 0x00000080
WARNING: Register at 0xDC is WRITABLE - potential DMA control register!
WARNING: Potential DMA register found: DMA Descriptor Control (0xE0) = 0x00000309
WARNING: Register at 0xE0 is WRITABLE - potential DMA control register!
##################################################
TESTING --- inspect_acpi_tables_minimal
##################################################
[*] Performing minimal ACPI table inspection...
Created directory: acpi_dumps for ACPI dumps
Running acpidump.exe to save ACPI tables...
Successfully saved ACPI dump (1719149 bytes) to acpi_dumps\acpi_dump.dat
##################################################
# Analyzing ACPI dump for DMA-related entries
##################################################
[*] Analyzing ACPI dump for DMA-related entries...
Analyzing ACPI dump file: acpi_dumps\acpi_dump.dat (1719149 bytes)
Found DSDT table at offset 444390
Extracted DSDT table to acpi_dumps\extracted_tables\DSDT.bin
No SystemMemory regions found in DSDT
##################################################
TESTING --- inspect_smi_handlers
##################################################
[*] Inspecting SMI handlers...
SMI handler inspection not available in this CHIPSEC build
SMI port 0xB2 current value: 0x52
Testing SMI command 0x4C...
Testing SMI command 0x4D...
Testing SMI command 0x51...
Testing SMI command 0x52...
##################################################
TESTING --- scan_platform_specific_features
##################################################
[*] Scanning for platform-specific DMA activation methods...
Found potential Root Complex Register register: 0x01100009
Found potential LPC Feature Control register: 0x00000309
WARNING: Register LPC Feature Control has bit 8 set, which might indicate legacy DMA support
##################################################
TESTING --- inspect_smi_handlers_safe
##################################################
[*] Safely inspecting SMI-related configuration (read-only)...
SMRAM control register: 0x00000000
SMI_EN register: 0x00000000
SMI_STS register: 0x00000000
APM status port (0xB3): 0x00
SMI-related inspection completed safely (read-only)
##################################################
TESTING --- scan_platform_specific_features_enhanced
##################################################
[*] Enhanced scan for platform-specific DMA activation methods...
Scanning Host Bridge: VID=0x8086, DID=0x3EC2
Interesting register at offset 0x40: 0xFED19001
Interesting register at offset 0x48: 0xFED10001
Interesting register at offset 0x50: 0x00000003
Interesting register at offset 0x54: 0x00000029
Interesting register at offset 0x58: 0x00000004
Interesting register at offset 0x5C: 0x3F000001
Interesting register at offset 0x60: 0xE0000001
Interesting register at offset 0x68: 0xFED18001
Interesting register at offset 0x70: 0xFE000000
Interesting register at offset 0x74: 0x00000007
Interesting register at offset 0x78: 0xFE000C00
Interesting register at offset 0x7C: 0x0000007F
Interesting register at offset 0x80: 0x11111111
Interesting register at offset 0x84: 0x00111111
Interesting register at offset 0x88: 0x0000001A
Interesting register at offset 0x90: 0xFE000001
Interesting register at offset 0x94: 0x00000007
Interesting register at offset 0x98: 0xBDF00001
Interesting register at offset 0x9C: 0x00000008
Interesting register at offset 0xA0: 0x00000001
Interesting register at offset 0xA4: 0x00000008
Interesting register at offset 0xA8: 0xBE000001
Interesting register at offset 0xAC: 0x00000008
Interesting register at offset 0xB0: 0x40000001
Interesting register at offset 0xB4: 0x40000001
Interesting register at offset 0xB8: 0x3F000001
Interesting register at offset 0xBC: 0x40000001
Interesting register at offset 0xE0: 0x01100009
Interesting register at offset 0xE4: 0x620120AD
Interesting register at offset 0xE8: 0xA4E400C8
Interesting register at offset 0xEC: 0x0002C000
Interesting register at offset 0xF4: 0x000C0FC8
Scanning PCI Express: VID=0x8086, DID=0x1901
Interesting register at offset 0x78: 0x00176200
Interesting register at offset 0x7C: 0x0A000000
Interesting register at offset 0x80: 0xC8039001
Interesting register at offset 0x84: 0x00000008
Interesting register at offset 0x88: 0x0000800D
Interesting register at offset 0x8C: 0x50001458
Interesting register at offset 0x90: 0x0000A005
Interesting register at offset 0xA0: 0x01420010
Interesting register at offset 0xA4: 0x00008001
Interesting register at offset 0xAC: 0x0261AD03
Interesting register at offset 0xB0: 0xD1010040
Interesting register at offset 0xB4: 0x000C2580
Interesting register at offset 0xB8: 0x00480000
Interesting register at offset 0xC4: 0x00080B80
Interesting register at offset 0xC8: 0x00006400
Interesting register at offset 0xCC: 0x0000000E
Interesting register at offset 0xD0: 0x001E0043
Interesting register at offset 0xF0: 0x00016000
Interesting register at offset 0xF4: 0x3201014E
Interesting register at offset 0xFC: 0x001000E0
Scanning LPC Bridge: VID=0x8086, DID=0xA305
Interesting register at offset 0x64: 0x000000D0
Interesting register at offset 0x80: 0x3F0F0070
Interesting register at offset 0x84: 0x007C0A01
Interesting register at offset 0x88: 0x000C0081
Interesting register at offset 0xD0: 0x00112233
WARNING: Potential DMA control register in LPC bridge: 0xD0 = 0x00112233
Interesting register at offset 0xD4: 0x00004567
WARNING: Potential DMA control register in LPC bridge: 0xD4 = 0x00004567
Interesting register at offset 0xD8: 0x0000FFCF
WARNING: Potential DMA control register in LPC bridge: 0xD8 = 0x0000FFCF
Interesting register at offset 0xDC: 0x00000080
WARNING: Potential DMA control register in LPC bridge: 0xDC = 0x00000080
Interesting register at offset 0xE0: 0x00000309
WARNING: Potential DMA control register in LPC bridge: 0xE0 = 0x00000309
Interesting register at offset 0xF8: 0x01110FB5
Scanning SMBus Controller: VID=0x8086, DID=0xA348
Interesting register at offset 0x48: 0x007B09FF
Interesting register at offset 0x50: 0xC0438001
Interesting register at offset 0x54: 0x00000008
Interesting register at offset 0x60: 0x00800005
Interesting register at offset 0x70: 0x00910010
Interesting register at offset 0x74: 0x10000000
Interesting register at offset 0x78: 0x00102800
Interesting register at offset 0x80: 0xF0146009
Interesting register at offset 0x84: 0x01400010
Interesting register at offset 0x8C: 0x000104A1
Interesting register at offset 0x90: 0x00080800
Interesting register at offset 0xC0: 0x21020608
Interesting register at offset 0xC4: 0x04806000
Interesting register at offset 0xC8: 0x82A50C00
Interesting register at offset 0xCC: 0x00030010
Interesting register at offset 0xD0: 0x02B50C00
Interesting register at offset 0xD4: 0x00030010
Interesting register at offset 0xF8: 0x01110FB5
Scanning EHCI Controller: VID=0x8086, DID=0xA360
Interesting register at offset 0x40: 0x90000255
Interesting register at offset 0x44: 0x80000000
Interesting register at offset 0x48: 0x06110506
Interesting register at offset 0x50: 0x40038C01
Interesting register at offset 0x54: 0x00000008
Interesting register at offset 0x60: 0x00000020
Interesting register at offset 0x64: 0x00004000
Interesting register at offset 0x6C: 0x00400000
Interesting register at offset 0x74: 0xE0000000
Interesting register at offset 0x8C: 0x0081A405
Interesting register at offset 0x90: 0xFEE003D0
Interesting register at offset 0xA0: 0x00000004
Interesting register at offset 0xA4: 0xF0140009
Interesting register at offset 0xA8: 0x01400010
Interesting register at offset 0xB0: 0x00008001
Interesting register at offset 0xB4: 0x000E0D38
Interesting register at offset 0xBC: 0x40000000
Interesting register at offset 0xF8: 0x01110FB5
Scanning for Super I/O chips...
Found Super I/O chip: ID=0x8688
Logical device 0: ID=0x01
WARNING: Logical device 0 is using DMA channel 7
Logical device 4: ID=0x01
WARNING: Logical device 4 is using DMA channel 4
Logical device 5: ID=0x01
WARNING: Logical device 5 is using DMA channel 4
Logical device 6: ID=0x01
WARNING: Logical device 6 is using DMA channel 4
Found Super I/O chip: ID=0xFFFF
Logical device 0: ID=0xFF
WARNING: Logical device 0 is using DMA channel 255
Logical device 1: ID=0xFF
WARNING: Logical device 1 is using DMA channel 255
Logical device 2: ID=0xFF
WARNING: Logical device 2 is using DMA channel 255
Logical device 3: ID=0xFF
WARNING: Logical device 3 is using DMA channel 255
Logical device 4: ID=0xFF
WARNING: Logical device 4 is using DMA channel 255
Logical device 5: ID=0xFF
WARNING: Logical device 5 is using DMA channel 255
Logical device 6: ID=0xFF
WARNING: Logical device 6 is using DMA channel 255
Logical device 7: ID=0xFF
WARNING: Logical device 7 is using DMA channel 255
Testing legacy DMA controller I/O ports...
DMA1 Status (port 0x08): 0xFF
DMA1 Command (port 0x08): 0xFF
DMA1 Request (port 0x09): 0xFF
DMA1 Mask Bit (port 0x0A): 0xFF
DMA1 Mode (port 0x0B): 0xFF
DMA1 Clear Flip-Flop (port 0x0C): 0xFF
DMA1 Master Clear (port 0x0D): 0xFF
DMA1 Clear Mask (port 0x0E): 0xFF
DMA1 Mask All (port 0x0F): 0xFF
DMA2 Status (port 0xC8): 0xFF
DMA2 Command (port 0xC8): 0xFF
DMA2 Request (port 0xC9): 0xFF
DMA2 Mask Bit (port 0xCA): 0xFF
DMA2 Mode (port 0xCB): 0xFF
DMA2 Clear Flip-Flop (port 0xCC): 0xFF
DMA2 Master Clear (port 0xCD): 0xFF
DMA2 Clear Mask (port 0xCE): 0xFF
DMA2 Mask All (port 0xCF): 0xFF
DMA Page Channel 0 (port 0x87): 0xFF
DMA Page Channel 1 (port 0x83): 0xFF
DMA Page Channel 2 (port 0x81): 0xFF
DMA Page Channel 3 (port 0x82): 0xFF
DMA Page Channel 4 (port 0x8F): 0xFF
DMA Page Channel 5 (port 0x8B): 0xFF
DMA Page Channel 6 (port 0x89): 0xFF
DMA Page Channel 7 (port 0x8A): 0xFF
[*] WARNING: Potential hidden DMA registers found.
Proceeding with non-invasive analysis only to avoid system instability.
##################################################
TESTING --- safer_dma_test
##################################################
[*] Performing safer DMA register testing...
[*] Monitoring DMA registers for passive changes...
[*] Initial register values:
ctrl: 0x00112233
stat: 0x00004567
tc: 0x0000FFCF
addr: 0x00000080
desc: 0x00000309
[*] Testing individual bits (safer approach)...
Testing bit 0: 0x00112233 -> 0x00112232
ISA DMA status: 0xFF
Testing bit 1: 0x00112233 -> 0x00112231
ISA DMA status: 0xFF
Testing bit 2: 0x00112233 -> 0x00112237
ISA DMA status: 0xFF
Testing bit 3: 0x00112233 -> 0x0011223B
ISA DMA status: 0xFF
Testing bit 4: 0x00112233 -> 0x00112223
ISA DMA status: 0xFF
Testing bit 5: 0x00112233 -> 0x00112213
ISA DMA status: 0xFF
Testing bit 6: 0x00112233 -> 0x00112273
ISA DMA status: 0xFF
Testing bit 7: 0x00112233 -> 0x001122B3
ISA DMA status: 0xFF
[*] Testing correlation with traditional DMA registers...
##################################################
TESTING --- safer_dma_test_two
##################################################
[*] Performing safer DMA register analysis...
Reading initial register values...
ctrl: 0x00112233
stat: 0x00004567
tc: 0x0000FFCF
addr: 0x00000080
desc: 0x00000309
Analyzing Control Register bit patterns:
Bit 0 (Enable/Start): 1
Bit 1 (Direction (0=Read, 1=Write)): 1
Bit 2 (Mode bit 0): 0
Bit 3 (Mode bit 1): 0
Bit 4 (Channel select bit 0): 1
Bit 5 (Channel select bit 1): 1
Bit 7 (Interrupt Enable): 0
Bit 8 (Auto-initialize): 0
Bit 16 (Burst mode): 1
Bit 31 (Master Enable): 0
Analyzing Status Register bit patterns:
Bit 0 (Busy/Complete): 1
Bit 1 (Transfer Complete): 1
Bit 2 (Error): 1
Bit 4 (Channel 0 status): 0
Bit 5 (Channel 1 status): 1
Bit 7 (Interrupt pending): 0
[*] Testing correlation with traditional DMA...
Setting traditional DMA channel 1 mode (no actual transfer)...
No register changes detected after DMA mode set
[*] Performing safe register modification tests...
Testing toggle of bit 8 in control register: 0x00112233 -> 0x00112333
Readback: 0x00112333, Status: 0x00004567
Testing toggle of bit 16 in control register: 0x00112233 -> 0x00102233
Readback: 0x00102233, Status: 0x00004567
Testing toggle of bit 24 in control register: 0x00112233 -> 0x01112233
Readback: 0x01112233, Status: 0x00004567
[*] Testing register relationships...
Writing test pattern 0xAABBCCDD to address register...
WARNING: Address register didn't accept write: wrote 0xAABBCCDD, read 0x0000008D
Writing test count 0x00001234 to transfer count register...
WARNING: Transfer count register behavior: wrote 0x00001234, read 0x00009204
Masked bits: 0x00008030
[*] Analysis Conclusions:
Likely register functions:
0xD0: Control register - contains mode/enable bits
0xD4: Status register - may indicate transfer status
0xD8: Transfer count - specifies bytes to transfer
0xDC: DMA address - source or target memory location
0xE0: Descriptor - may contain additional control bits
##################################################
TESTING --- monitor_dma_during_system_events
##################################################
[*] Setting up monitoring for DMA registers during system events...
Monitoring during Disk I/O...
Please open a file or folder in File Explorer...
Press Enter after performing the activity...
No register changes detected during Disk I/O
Monitoring during Network activity...
Please open a web page in your browser...
Press Enter after performing the activity...
No register changes detected during Network activity
Monitoring during Audio playback...
Please play an audio file...
Press Enter after performing the activity...
No register changes detected during Audio playback
Monitoring during USB device access...
Please plug in or access a USB device...
Press Enter after performing the activity...
No register changes detected during USB device access
[*] Polling DMA registers for 30 seconds...
Polling for 10.1s, 0 changes detected
Polling for 20.1s, 0 changes detected
[*] Polling Results Summary:
Total polls: 299
Total register changes: 0
Register ctrl remained constant at 0x00112233
Register stat remained constant at 0x00004567
Register tc remained constant at 0x0000FFCF
Register addr remained constant at 0x00000080
Register desc remained constant at 0x00000309
##################################################
TESTING --- monitor_dma_registers_long_term
##################################################
Starting long-term monitoring, logging to monitor_dma_registers_long_term.log
Press Ctrl+C to stop monitoring
Monitoring stopped by user
[*] Test Results Summary:
Traditional 8237A DMA registers do not respond
WARNING: Found potential hidden H81-style DMA registers in Z390
WARNING: Safe testing completed without attempting actual DMA transfers
WARNING: See log for detailed register analysis
[CHIPSEC] *************************** SUMMARY ***************************
[CHIPSEC] Time elapsed 101.342
[CHIPSEC] Modules failed to run 0:
[CHIPSEC] Modules passed 0:
[CHIPSEC] Modules information 0:
[CHIPSEC] Modules failed 0:
[CHIPSEC] Modules with warnings 1:
WARNING: chipsec.modules.common.lpc_dma_h81_z390_test
[CHIPSEC] Modules not applicable 0:
[CHIPSEC] Modules total 1
[CHIPSEC] *****************************************************************
